matchpathcon(3)

💖 matchpathcon(3) — SELinux API documentation 💖

okay bestie, welcome to matchpathcon(3), straight out of the SELinux API documentation, and honestly? she's giving legacy icon. we're gonna get you the default SELinux security context for a path, from the file contexts config, no cap.

---

✨ NAME ✨

matchpathcon, matchpathcon_index — get the default SELinux security context for the specified path from the file contexts configuration 🎀

---

🌸 SYNOPSIS 🌸

#include <selinux/selinux.h>

int matchpathcon_init(const char *path);

int matchpathcon_init_prefix(const char *path, const char *prefix);

int matchpathcon_fini(void);

int matchpathcon(const char *path, mode_t mode, char **con);

int matchpathcon_index(const char *name, mode_t mode, char **con);

---

🦋 DESCRIPTION 🦋

so first things first, and I need you to hear me on this one:

🚨 this whole family of functions is deprecated. like, retired. for new code, please use selabel_open(3) with the SELABEL_CTX_FILE backend instead of matchpathcon_init(), use selabel_close(3) instead of matchpathcon_fini(), and use selabel_lookup(3) instead of matchpathcon().

the rest of what I'm about to tell you is for the legacy interface, iykyk. she's still here, she's just vintage 💅

🌈 the functions, one by one 🌈

matchpathcon_init() loads the file contexts configuration specified by path into memory, so the matchpathcon() calls that come after it can use it. if path is NULL, then the active file contexts configuration gets loaded by default — that's literally the path returned by selinux_file_context_path(3). and unless the MATCHPATHCON_BASEONLY flag has been set via set_matchpathcon_flags(3), files with the same path prefix but a .homedirs and .local suffix are also looked up and loaded if they're present. those files are what provide dynamically generated entries for user home directories and for local customizations. cute, right? 💖

matchpathcon_init_prefix() is the same as matchpathcon_init() but only loads entries with regular expressions whose first pathname component is a prefix of prefix. like, pass "/dev" if you're only ever gonna call matchpathcon() with pathnames beginning with /dev. but — and this is the tea — this optimization is no longer necessary thanks to the use of file_contexts.bin files with precompiled regular expressions, so using this interface is deprecated. periodt. 🫶

matchpathcon_fini() frees the memory allocated by a prior call to matchpathcon_init.() ✨ you can use it to free and reset the internal state between multiple matchpathcon_init() calls, or just to free memory when you're done using matchpathcon(). clean up after yourself, bestie, it's self-care 🧚

matchpathcon() matches the specified pathname against the file contexts configuration and sets the security context con to refer to the resulting context. quick note on the pathname: it gets transformed via realpath(3), excepting any final symbolic link component if S_IFLNK was specified as the mode. and then it matches mode against the configuration too.

a few things you need to know, no skips:

• the caller must free the returned security context con using freecon(3) when finished using it. not optional. that's your memory and it's your job 💀
• mode can be 0 to disable mode matching, but it should be provided whenever possible, since it may affect the matching.
• only the file format bits (i.e. the file type) of the mode are used.
• if matchpathcon_init() has not already been called, then this function will call it upon its first invocation with a NULL path, defaulting to the active file contexts configuration. she's self-sufficient like that 👑

matchpathcon_index() is the same as matchpathcon() but returns a specification index that can later be used in a matchpathcon_filespec_add(3) call. main character energy, honestly ⭐

---

💜 RETURN VALUE 💜

returns zero on success or -1 otherwise. that's it, that's the vibe check.

---

🎀 SEE ALSO 🎀

• selinux(8)
• set_matchpathcon_flags(3)
• set_matchpathcon_invalidcon(3)
• set_matchpathcon_printf(3)
• matchpathcon_filespec_add(3)
• matchpathcon_checkmatches(3)
• freecon(3)
• setfilecon(3)
• setfscreatecon(3)

---

and that's the whole page, bestie!! 🎉 this one was brought to you by stephen.smalley.work@gmail.com, dated 21 November 2009 — yes, she's an elder, and we respect her 💖✨🌸🦋 go forth and set those contexts responsibly 🫶👑