runcon — run command with specified SELinux security context

Examples (TL;DR)


runcon CONTEXT COMMAND [args]
runcon [ -c ] [-u USER] [-r ROLE] [-t TYPE] [-l RANGE] COMMAND [args]


Run COMMAND with completely-specified CONTEXT, or with current or transitioned security context modified by one or more of LEVEL, ROLE, TYPE, and USER.

If none of -c, -t, -u, -r, or -l, is specified, the first argument is used as the complete context.  Any additional arguments after COMMAND are interpreted as arguments to the command.

Note that only carefully-chosen contexts are likely to successfully run.

Run a program in a different SELinux security context. With neither CONTEXT nor COMMAND, print the current security context.

Mandatory arguments to long options are mandatory for short options too.


Complete security context

-c, --compute

compute process transition context before modifying

-t, --type=TYPE

type (for same role as parent)

-u, --user=USER

user identity

-r, --role=ROLE


-l, --range=RANGE



display this help and exit


output version information and exit


Written by Russell Coker.

Reporting Bugs

GNU coreutils online help: <>
Report any translation bugs to <>

See Also

Full documentation <>
or available locally via: info '(coreutils) runcon invocation'

Referenced By

newrole(1), sandbox(8), setpriv(1), seunshare(8).

October 2019 GNU coreutils 8.31