get_ordered_context_list(3)

💖 get_ordered_context_list — the SELinux glow-up manual (section 3, bestie) 💖

okay so this whole page lives in the SELinux part of the manual, and it's all about figuring out which SELinux context a user session gets to wear. slay. let's go ✨

---

🌸 NAME 🌸

get_ordered_context_list, get_ordered_context_list_with_level, get_default_context, get_default_context_with_level, get_default_context_with_role, get_default_context_with_rolelevel, query_user_context, manual_user_enter_context, get_default_role — determine SELinux context(s) for user sessions

yes bestie, that's a whole friend group in one function family. they all show up to the party together. 💅

---

🎀 SYNOPSIS 🎀

#include <selinux/selinux.h>
#include <selinux/get_context_list.h>

int get_ordered_context_list(const char *user, const char *fromcon, char
***list);

int get_ordered_context_list_with_level(const char *user, const char
*level, const char *fromcon, char ***list);

int get_default_context(const char *user, const char *fromcon, char
**newcon);

int get_default_context_with_level(const char *user, const char *level,
const char *fromcon, char **newcon);

int get_default_context_with_role(const char *user, const char *role,
const char *fromcon, char **newcon);

int get_default_context_with_rolelevel(const char *user, const char
*role, const char *level, const char *fromcon, char **newcon);

int query_user_context(char **list, char **newcon);

int manual_user_enter_context(const char *user, char **newcon);

int get_default_type(const char *role, char **type);

---

✨ DESCRIPTION ✨

okay so picture this: this whole little family of functions is your go-to for getting either a prioritized list of all the reachable security contexts for a given SELinux user, or a single default (highest priority) context for a given SELinux user — specifically so that login-like programs can use it. it's giving "who am I allowed to be today" energy. 👑

BIG important thing bestie: these functions take a SELinux user identity that must be defined in the SELinux policy as their input. not a Linux username. those are two different things and mixing them up is a whole vibe check failure, fr fr.

so most callers should typically do this little two-step:

1. call getseuserbyname(3) first to look up the SELinux user identity and level for a given Linux username 🦋
2. then invoke one of get_ordered_context_list_with_level() or get_default_context_with_level() with the returned SELinux user and level as inputs

main character sequence, honestly.

---

💜 the functions, one by one 💜

• get_ordered_context_list() — obtains the list of contexts for the specified SELinux user identity that are reachable from the specified fromcon context, based on the global /etc/selinux/{SELINUXTYPE}/contexts/default_contexts file and the per-user /etc/selinux/{SELINUXTYPE}/contexts/users/<username> file if it exists. the fromcon parameter may be NULL to indicate that the current context should be used. it returns the number of contexts in the list, or -1 upon errors. and listen — the list must be freed using the freeconary(3) function. do not skip that part. 😤
• get_ordered_context_list_with_level() — invokes the get_ordered_context_list() function and applies the specified level. that's it, that's the whole thing, and it ate. 💅
• get_default_context() — same as get_ordered_context_list() but only returns a single context, which has to be freed with freecon(3). one context. minimalism. iconic.
• get_default_context_with_level() — invokes the get_default_context() function and applies the specified level. ✨
• get_default_context_with_role() — same as get_default_context() but only returns a context with the specified role, returning -1 if no such context is reachable for the user. so if that role isn't reachable? -1. no context for you. 🫶
• get_default_context_with_rolelevel() — invokes the get_default_context_with_role() function and applies the specified level. 🎀
• query_user_context() — takes a list of contexts, queries the user via stdin/stdout as to which context they want, and returns a new context as selected by the user (which has to be freed with freecon(3)). it's literally asking them. democracy, but for contexts. 🗳️
• manual_user_enter_context() — allows the user to manually enter a context as a fallback if a list of authorized contexts could not be obtained. caller must free via freecon(3). emergency mode, but make it fashion. 💀
• get_default_type() — Get the default type (domain) for role and set type to refer to it, which has to be freed with free. yes bestie, that one is plain free, not freecon. keep your frees straight or the memory leaks will humble you. 🌈

---

🔥 RETURN VALUE 🔥

• get_ordered_context_list() and get_ordered_context_list_with_level() return the number of contexts in the list upon success, or -1 upon errors.
• the other functions return 0 for success or -1 for errors.

that's the whole contract. -1 means something went wrong, bestie. don't ignore it. 😭

---

🦋 SEE ALSO 🦋

selinux(8), freeconary(3), freecon(3), security_compute_av(3), getseuserbyname(3)

---

reminder bestie: free your lists with freeconary(3), free your single contexts with freecon(3), free that default type with free — and always pass a real SELinux user identity, not a Linux username. iykyk. 💖

---

this page was written by russell@coker.com.au and it's dated 1 January 2004 — so yes, she's been serving accurate SELinux knowledge since the early aughts and she's still THAT girl. periodt. 👑🌸