selabel_open(3)

✨ selabel_open(3) — SELinux API documentation ✨

okay bestie, sit down, hydrate, and let me tell you about the two little functions that run the whole SELinux labeling situation: selabel_open and selabel_close. 💅

---

🎀 NAME 🎀

selabel_open, selabel_close — the userspace SELinux labeling interface, no cap.

---

🌸 SYNOPSIS 🌸

#include <selinux/selinux.h>
#include <selinux/label.h>

struct selabel_handle *selabel_open(unsigned int backend,
                                    const struct selinux_opt *options,
                                    unsigned nopt);

void selabel_close(struct selabel_handle *hnd);

---

💖 DESCRIPTION 💖

So selabel_open() is the glow-up moment where you initialize a labeling handle — you're gonna use that handle for all your lookup operations later. The backend argument tells it which backend you're opening, and the whole roster of current backends is chilling down in BACKENDS below. 👑

The options argument should be NULL, OR a pointer to an array of selinux_opt structs that's nopt long:

struct selinux_opt {
    int         type;
    const char  *value;
};

Which option types exist? They're described in GLOBAL OPTIONS below, plus in the docs for each individual backend, so go read those too bestie. 🫶 On success you get back a non-NULL value, and you use that in all your later label operations.

Then selabel_close() is the "okay we're done here" — it terminates use of a handle and frees any internal resources attached to it. After you've made this call, you must NOT use the handle again. Like, ever. It's over. 💀

---

✨ GLOBAL OPTIONS ✨

These are the global options you can pass to selabel_open():

• SELABEL_OPT_UNUSED — the option with a type code of zero is a no-op. Which is lowkey genius, because it means you can initialize an array of options to zero and any elements you never touched won't throw an error at you. 🧚
• SELABEL_OPT_VALIDATE — a non-null value for this one turns on context validation. By default it uses security_check_context(3), but you can hand it a custom validation function through selinux_set_callback(3). Heads up though: an invalid context might not be treated as an error unless it's actually encountered during a lookup operation. So it's giving "we'll deal with it when we get there." 🙈
• SELABEL_OPT_DIGEST — a non-null value here enables generation of a SHA256 digest of the spec files loaded, exactly as described in selabel_digest(3). 🔥

---

🌈 BACKENDS 🌈

• SELABEL_CTX_FILE — the file contexts backend, fully described in selabel_file(5).
• SELABEL_CTX_MEDIA — the media contexts backend, described in selabel_media(5).
• SELABEL_CTX_X — the X Windows contexts backend, described in selabel_x(5).
• SELABEL_CTX_DB — the database objects contexts backend, described in selabel_db(5).

---

⭐ RETURN VALUE ⭐

On success, you get a non-NULL handle value back. 🎉 On error, NULL is returned and errno is set appropriately — classic, honestly.

---

👑 AUTHOR 👑

Eamon Walsh <ewalsh@tycho.nsa.gov> — king behavior, we thank him for his service. 🫶

---

💜 SEE ALSO 💜

selabel_lookup(3), selabel_stats(3), selinux_set_callback(3), selinux(8)

---

and that's the whole page bestie!! this one's from the SELinux API documentation, dated 18 Jun 2007 — yes, 2007, it's vintage, it's iconic, it's still slaying. go forth and label things responsibly 💖✨🎀