setfilecon(3)

💅 setfilecon — the SELinux glow-up page 💅

okay bestie, welcome to setfilecon(3), straight out of the SELinux API documentation ✨ this is the little family of functions that gives a file a whole new security context. it's giving makeover montage, but for extended attributes. no cap.

✨ NAME ✨

setfilecon, fsetfilecon, lsetfilecon — set SELinux security context of a file 🎀

🌸 SYNOPSIS 🌸

#include <selinux/selinux.h>

int setfilecon(const char *path, const char *con);

int setfilecon_raw(const char *path, const char *con);

int lsetfilecon(const char *path, const char *con);

int lsetfilecon_raw(const char *path, const char *con);

int fsetfilecon(int fd, const char *con);

int fsetfilecon_raw(int fd, const char *con);

🦋 DESCRIPTION 🦋

so setfilecon() sets the security context of the file system object. that's the whole vibe. main character behavior, honestly 💖

lsetfilecon() is identical to setfilecon, except in the case of a symbolic link — there, the link itself has its context set, not the file that it refers to. it does NOT follow the link. lowkey important, don't skip this one 👑

fsetfilecon() is identical to setfilecon too, only the open file pointed to by filedes (as returned by open(2)) has its context set in place of path. and since libselinux 3.4, a file opened via O_PATH is supported 🎉 that's the upgrade arc fr fr.

setfilecon_raw(), lsetfilecon_raw(), and fsetfilecon_raw() behave identically to their non-raw counterparts but do not perform context translation. raw is raw, no filter, no translation layer, periodt 💅

⭐ RETURN VALUE ⭐

• on success, zero is returned ✨
• on failure, -1 is returned and errno is set appropriately 😭

💀 ERRORS 💀

if there's not enough space left to store the extended attribute, errno gets set to either ENOSPC, or EDQUOT if quota enforcement was the cause. not me getting hit with a quota 😭

if extended attributes are not supported by the filesystem, or are disabled, errno is set to ENOTSUP. the filesystem said "no 💅" and honestly we respect it.

also: the errors documented for the stat(2) system call are applicable here too. so go read that one, bestie, iykyk 🫶

🌈 SEE ALSO 🌈

• selinux(3)
• freecon(3)
• getfilecon(3)
• setfscreatecon(3)

and that's the whole page, you ate it 💖✨

cute lil sign-off: this gem is from the SELinux API documentation, setfilecon(3), and the page itself was written by russell@coker.com.au, dated 1 January 2004. iconic. historic. obsessed. 🎀🦋🌸