selinux可以在根目录下创建.autorelabel文件并输入"-F"的内容，系统重启后会根据策略库的默认配置强制刷新所有文件的安全上下文。

1、如何调用.autorelabel文件

.autorelabel文件是由selinux-autorelabel的systemd服务调用的，根据该服务的配置可以看到，该服务为oneshot类型，仅在系统启动时运行。运行时调用selinux-autorelabel可执行文件进行下一步处理。

[root@localhost ~]# cat /usr/lib/systemd/system/selinux-autorelabel.service 
[Unit]
Description=Relabel all filesystems
DefaultDependencies=no
Conflicts=shutdown.target
After=sysinit.target
Before=shutdown.target
ConditionSecurity=selinux

[Service]
ExecStart=/usr/libexec/selinux/selinux-autorelabel #2
Type=oneshot # 1
TimeoutSec=0
RemainAfterExit=yes
StandardInput=tty
[root@localhost ~]# cat /usr/lib/systemd/system/selinux-autorelabel.target 
[Unit]
Description=Relabel all filesystems and reboot
DefaultDependencies=no
Requires=sysinit.target selinux-autorelabel.service
Conflicts=shutdown.target
After=sysinit.target selinux-autorelabel.service
ConditionSecurity=selinux

查看selinux-autorelabel脚本的源码可以看到。该脚本会根据目录restorecon所有目录的安全上下文，但没有强制刷新。然后会读取/.autorelabel的文件内容，如果autorelabel存在并为-F，那么将调用二进制文件/sbin/fixfiles强制刷新文件的安全上下文，最后会删除autorelabel文件并重启。

[root@localhost ~]# cat /usr/libexec/selinux/selinux-autorelabel 
#!/bin/bash
#
# Do automatic relabelling
#

# . /etc/init.d/functions

# If the user has this (or similar) UEFI boot order:
#
#             Windows | grub | Linux
#
# And decides to boot into grub/Linux, then the reboot at the end of autorelabel
# would cause the system to boot into Windows again, if the autorelabel was run.
#
# This function restores the UEFI boot order, so the user will boot into the
# previously set (and expected) partition.
efi_set_boot_next() {
    # NOTE: The [ -x /usr/sbin/efibootmgr ] test is not sufficent -- it could
    #       succeed even on system which is not EFI-enabled...
    if ! efibootmgr > /dev/null 2>&1; then
        return
    fi

    # NOTE: It it possible that some other services might be setting the
    #       'BootNext' item for any reasons, and we shouldn't override it if so.
    if ! efibootmgr | grep --quiet -e 'BootNext'; then
        CURRENT_BOOT="$(efibootmgr | grep -e 'BootCurrent' | sed -re 's/(^.+:[[:space:]]*)([[:xdigit:]]+)/\2/')"
        efibootmgr -n "${CURRENT_BOOT}" > /dev/null 2>&1
    fi
}

relabel_selinux() {
    # if /sbin/init is not labeled correctly this process is running in the
    # wrong context, so a reboot will be required after relabel
    AUTORELABEL=
    . /etc/selinux/config
    echo "0" > /sys/fs/selinux/enforce
    [ -x /bin/plymouth ] && plymouth --quit

    if [ "$AUTORELABEL" = "0" ]; then
	echo
	echo $"*** Warning -- SELinux ${SELINUXTYPE} policy relabel is required. "
	echo $"*** /etc/selinux/config indicates you want to manually fix labeling"
	echo $"*** problems. Dropping you to a shell; the system will reboot"
	echo $"*** when you leave the shell."
	sulogin

    else
	echo
	echo $"*** Warning -- SELinux ${SELINUXTYPE} policy relabel is required."
	echo $"*** Relabeling could take a very long time, depending on file"
	echo $"*** system size and speed of hard drives."

	FORCE=`cat /.autorelabel`
        [ -x "/usr/sbin/quotaoff" ] && /usr/sbin/quotaoff -aug
	/sbin/fixfiles $FORCE restore # 2
    fi

    rm -f  /.autorelabel # 3
    /usr/lib/dracut/dracut-initramfs-restore
    efi_set_boot_next
    if [ -x /usr/bin/grub2-editenv ]; then
        grub2-editenv - incr boot_indeterminate >/dev/null 2>&1
    fi
    sync
    systemctl --force reboot # 4
}

# Check to see if a full relabel is needed
if [ "$READONLY" != "yes" ]; then
    restorecon $(awk '!/^#/ && $4 !~ /noauto/ && $2 ~ /^\// { print $2 }' /etc/fstab) >/dev/null 2>&1 # 1
    relabel_selinux
fi

2、fixfiles处理分析

selinux-autorelabel调用指令/sbin/fixfiles -F restore。fixfiles读取到-F和restore后，根据系统目录，最终调用/sbin/setfiles来刷新安全上下文。此处值得注意的点是，setfiles刷新目录的安全上下文时，如果碰到其中某个文件存在权限限制（例如不可更改的属性），那么会权限错误，并推出该目录的刷新，继续下一个目录。

[root@localhost ~]# cat /sbin/fixfiles
...
#
# restore
# if called with -n will only check file context
#
restore () {
...
    *)
        if [ -n "${FILESYSTEMSRW}" ]; then
            LogReadOnly
            echo "${OPTION}ing `echo ${FILESYSTEMSRW}`"
            echo "${SETFILES} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} $* -q ${FC} ${FILESYSTEMSRW}"
            ${SETFILES} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} $* -q ${FC} ${FILESYSTEMSRW}
        else
            echo >&2 "fixfiles: No suitable file systems found"
        fi
...
process() {
#
# Make sure they specified one of the three valid commands
#
case "$1" in
    restore) restore Relabel;;
...
while getopts "N:BC:FfR:l:vMT:" i; do
    case "$i" in
...
	F)
		FORCEFLAG="-F"
		;;
...