SELINUX_FILE_CONTEXT_VERIFY(3)

✨ selinux_file_context_verify(3) ✨

okay so bestie, we're in the Library Functions Manual today and the function we're stanning is selinux_file_context_verify — she lives in section 3 with all the other library functions 🎀

🌸 NAME 🌸

selinux_file_context_verify — compare the SELinux security context on disk to the default security context required by the policy file contexts file 💅

🦋 SYNOPSIS 🦋

#include <selinux/selinux.h>

int selinux_file_context_verify(const char *path, mode_t mode);

💖 DESCRIPTION 💖

selinux_file_context_verify() does a little vibe check — it compares the context of the path you hand it, the one sitting on disk in the extended attribute, against the system default entry that lives in the file contexts series of files. like, on-disk reality vs. policy's dream scenario, and she's the matchmaker ✨

The mode may be zero. (yes bestie, zero is a totally valid mode here, no cap)

⚠️ Heads up: the two contexts get compared for "significant" differences only — the user component of the contexts is ignored. There's a whole demonstration of this in the EXAMPLE section, so scroll down, iykyk 👀

🔥 RETURN VALUE 🔥

• 1 (one) — returned if the contexts significantly match. slay, they're compatible 💚
• 0 (zero) — returned if the contexts do not match, and errno gets set to either ENOENT or EINVAL for the reasons listed down in ERRORS, or if errno = 0 then the contexts just... did not match. the silence is loud 😭
• -1 — returned on failure, with errno set appropriately.

😭 ERRORS 😭

• ENOTSUP — if extended attributes are not supported by the file system. the filesystem said "not my thing" 🙈
• ENOENT — if there is no entry in the file contexts series of files, or the path does not exist. she's simply not there, bestie 💀
• EINVAL — if the entry in the file contexts series of files or the path are invalid, or the returned context fails validation. invalid, rejected, blocked 🚫
• ENOMEM — if the attempt to allocate memory failed. the memory budget said no 😔

🎀 FILES 🎀

The following configuration files — the file contexts series of files — supporting the active policy will be used (should they exist) to determine the path default context:

• contexts/files/file_contexts — This file must exist. non-negotiable, she's the main character 👑
• contexts/files/file_contexts.local — if it exists, it has local customizations. your personal touches 💅
• contexts/files/file_contexts.homedirs — if it exists, it has users home directory customizations. home sweet home 🏠
• contexts/files/file_contexts.subs — if it exists, it has substitutions that are then applied to the 'in memory' version of the file contexts files. swaps and swaps and swaps ✨

🌈 EXAMPLE 🌈

Say the files context is:

unconfined_u:object_r:admin_home_t:s0

and the default context defined in the file contexts file is:

system_u:object_r:admin_home_t:s0

then the actual strings compared are:

:object_r:admin_home_t:s0 and :object_r:admin_home_t:s0

see how the user part just got ghosted?? 👻 the user component is ignored, remember!

Therefore they will match and selinux_file_context_verify() will return 1. ate and left no crumbs 💚

⭐ SEE ALSO ⭐

• selinux(8) go read the big one, bestie 📖

and that's the whole page, fr fr — this was SELinux API documentation, dated 08 March 2011, section 3 (selinux_fi...text_verify(3)) 🫶 kisses, go verify those contexts, mwah 💋