getfscreatecon(3)

💖 getfscreatecon 💖

okay bestie, so this is the getfscreatecon page from the SELinux API documentation (that's the manual it lives in, mwah) — and no cap, it's lowkey one of the most useful lil corners of SELinux once you get it. sit down, grab a boba, we're learning about the security context used when you create a new file system object. yes. that. it's giving gatekeeper but make it per-thread. ✨

---

✨ NAME ✨

getfscreatecon, setfscreatecon — get or set the SELinux security context used for creating a new file system object 🎀

---

🦋 SYNOPSIS 🦋

#include <selinux/selinux.h>

int getfscreatecon(char **con);

int getfscreatecon_raw(char **con);

int setfscreatecon(const char *context);

int setfscreatecon_raw(const char *context);

---

🌸 DESCRIPTION 🌸

so getfscreatecon() retrieves the context used for creating a new file system object. the way that it hands you a context — if it's non-NULL, you gotta free it with freecon(3), okay? don't just leave it lying around, that's not the vibe. 🙈

and here's a cute lil detail: getfscreatecon() sets *con to NULL if no fscreate context has been explicitly set by the program (i.e. it's just using the default policy behavior). so NULL isn't an error, it's just "we're on default, bestie, nothing custom here". 💅

setfscreatecon() sets the context used for creating a new file system object. you can pass NULL to setfscreatecon() to reset back to the default policy behavior. and the fscreate context is automatically reset after the next execve(2), so a program doesn't need to explicitly sanitize it upon startup — the system already did that for you, iconic behavior honestly. 👑

setfscreatecon() can be applied prior to library functions that internally perform an file creation, in order to set an file context on the objects. so like, set it, then let the library do its lil creation thing, and boom — your context is applied. 🔥

getfscreatecon_raw() and setfscreatecon_raw() behave identically to their non-raw counterparts but do not perform context translation. that's the whole difference, fr fr. 💜

⚠️ Note: Signal handlers that perform a setfscreatecon() must take care to save, reset, and restore the fscreate context to avoid unexpected behavior. like… please. do not skip this. it will bite you. 😭

⚠️ Note: Contexts are thread specific. so your thread's context is your thread's context, not a shared group-chat situation. periodt. 🧚

---

⭐ RETURN VALUE ⭐

• On error, -1 is returned. 💀
• On success, 0 is returned. 🎉

that's it, that's the whole scale. binary. no in-between, no "it's complicated". slay.

---

👀 SEE ALSO 👀

• selinux(8)
• freecon(3)
• getcon(3)
• getexeccon(3)

---

okay that's the whole page, bestie — you ate this. go forth and set your fscreate contexts responsibly. 💖✨🎀🦋🌸

shoutout to russell@coker.com.au, who wrote this back on 1 January 2004 — a true legend, dropping SELinux knowledge before most of us could even spell SELinux. and it's all part of the SELinux API documentation, so you know it's official official. mwah. 💜🫶