getfilecon(3)

💅 getfilecon — SELinux API documentation ✨

okay bestie, so this is a page from the SELinux API documentation — the manual name is getfilecon and it lives in section 3 of the manual (that's the library-functions section, iykyk). it's all about peeking at a file's SELinux security context and honestly? iconic. 🎀

🌸 NAME 🌸

getfilecon, fgetfilecon, lgetfilecon — get SELinux security context of a file 👑

no cap, that's the whole job. grab the security context. slay.

✨ SYNOPSIS ✨

#include <selinux/selinux.h>

int getfilecon(const char *path, char **con);

int getfilecon_raw(const char *path, char **con);

int lgetfilecon(const char *path, char **con);

int lgetfilecon_raw(const char *path, char **con);

int fgetfilecon(int fd, char **con);

int fgetfilecon_raw(int fd, char **con);

six functions, all matching, all serving looks. 💖

🦋 DESCRIPTION 🦋

so here's the tea, bestie. 🍓

• getfilecon() — retrieves the context associated with the given path in the file system, and the length of the context is returned. literally just "hey what's this file's vibe" and it tells you. 💅
• lgetfilecon() — identical to getfilecon(), except in the case of a symbolic link, where the link itself is interrogated, not the file that it refers to. so it's the "don't look at the destination, look at the link, bestie" version. 🎀
• fgetfilecon() — identical to getfilecon(), only the open file pointed to by filedes (as returned by open(2)) is interrogated in place of path. and ooh, since libselinux 3.4 a file opened via O_PATH is supported. glow up fr fr. ✨
• getfilecon_raw(), lgetfilecon_raw() and fgetfilecon_raw() — they behave identically to their non-raw counterparts but do not perform context translation. raw is raw, no filter, no translation, just the context as it is. periodt. 💀

⚠️ important bestie: the returned context should be freed with freecon(3) if non-NULL. don't be out here leaking memory, that's not the vibe. 🫶

💀 RETURN VALUE 💀

okay so the receipts:

• on success, a positive number is returned indicating the size of the extended attribute value. so it's giving you a number AND the context. main character energy. 👑
• on failure, -1 is returned and errno is set appropriately.

and the errno lore, because context matters (literally):

• if the context does not exist, or the process has no access to this attribute, errno is set to ENODATA. it's not there, or it's not for you. 🙈
• if extended attributes are not supported by the filesystem, or are disabled, errno is set to ENOTSUP. the filesystem said "we don't do that here". 😭

and also — the errors documented for the stat(2) system call are also applicable here. so go read that one too, bestie. 🌈

🌟 SEE ALSO 🌟

• selinux(8)
• freecon(3)
• setfilecon(3)
• setfscreatecon(3)

go read these next, it's the friend group of manpages fr fr. 💜

russell@coker.com.au wrote this one, and it's dated 1 January 2004 — so yeah, this page is old enough to have its own aesthetic, and it's still serving. mwah. 💋✨