selabel_l...best_match(3)

🎀 selabel_l...best_match(3) — SELinux API documentation ✨

okay bestie, welcome to the selabel_l...best_match(3) page — it's from the SELinux API documentation and it's giving extremely niche but honestly kind of iconic energy 💅

---

🌸 NAME 🌸

selabel_lookup_best_match — obtain a best match SELinux security context.

Only supported on file backend. like. fr. don't come for me, that's just the rules 😭

---

🦋 SYNOPSIS 🦋

#include <selinux/selinux.h>
#include <selinux/label.h>

int selabel_lookup_best_match(struct selabel_handle *hnd,
                              char **context,
                              const char *key,
                              const char **links,
                              int type);

int selabel_lookup_best_match_raw(struct selabel_handle *hnd,
                                  char **context,
                                  const char *key,
                                  const char **links,
                                  int type);

two whole functions, both iconic, both taking the exact same arguments 🫶

---

💖 DESCRIPTION 💖

so selabel_lookup_best_match() does a best match lookup operation on the handle hnd, and it drops the result into the memory that context points to. and bestie, heads up: that memory is yours to deal with — the caller has to free it using freecon(3). no takebacks, no shortcuts ✨

the key parameter is a file path to check for best match, and it does that using zero or more link (aliases) parameters. the order of precedence for best match is, in order:

1. An exact match for the real path (key) or
2. An exact match for any of the links (aliases), or
3. The longest fixed prefix match.

like, that's the ranking. exact real path first, then aliases, then longest fixed prefix. periodt 👑

the type parameter is an optional file mode argument that should be set to the mode bits of the file, as determined by lstat(2). mode may be zero, however full matching may not occur. so like… you can skip it but you're lowkey leaving matches on the table 🙈

and then selabel_lookup_best_match_raw() behaves identically to selabel_lookup_best_match() but does not perform context translation. same vibes, one fewer step 💅

---

🌈 RETURN VALUE 🌈

• On success, zero is returned.
• On error, -1 is returned and errno is set appropriately.

---

💀 ERRORS 💀

• ENOENT — No context corresponding to the input key and type was found. she's just not there bestie 🫠
• EINVAL — The key and/or type inputs are invalid, or the context being returned failed validation, or a regular expression in the database failed to compile. three different ways to be mad, all of them valid ✨
• ENOMEM — An attempt to allocate memory failed. the RAM said no 😭

---

🧚 NOTES 🧚

Example usage — when a service creates a device node, it may also create one or more symlinks to the device node. These symlinks may be the only stable name for the device, e.g. if the partition is dynamically assigned. The file label backend supports this by looking up the "best match" for a device node based on its real path (key) and any links to it (aliases). The order of precedence for best match is described above.

like… that's the whole plot. dynamic partitions said "the symlink is the only name you're getting" and the file label backend said "say less, best match it is" 🔥

---

⭐ SEE ALSO ⭐

• selabel_open(3)
• selabel_stats(3)
• selinux_set_callback(3)
• selinux(8)
• lstat(2)
• selabel_file(5)

---

and that's the page bestie!! this one came from Security Enhanced Linux, dated 05 May 2015, and honestly it ate 💖 go free your context with freecon(3) and hydrate. mwah 🎀🦋