selinux_re...econ_xattr(3)

✨ selinux_restorecon_xattr ✨ — the <pink>manage your security.sehash xattr entries</pink> era 💅

okay bestie, this is section 3 of the SELinux API documentation and we're about to make extended attributes make sense, fr fr.

---

🌸 NAME 🌸

selinux_restorecon_xattr — manage default security.sehash extended attribute entries added by selinux_restorecon(3), setfiles(8) or restorecon(8).

like… it's the lil cleanup-and-look-at-your-xattrs bestie of the restorecon family. no cap. 🎀

---

🦋 SYNOPSIS 🦋

#include <selinux/restorecon.h>

int selinux_restorecon_xattr(const char *pathname,
                       unsigned int xattr_flags,
                       struct dir_xattr ***xattr_list);

three arguments, one header, zero drama. periodt. 💜

---

💖 DESCRIPTION 💖

so selinux_restorecon_xattr() hands you back a linked list of dir_xattr structures stuffed with the info described below, and what ends up in that list depends on:

• pathname — a directory tree that we're gonna search for security.sehash extended attribute entries. 🌈
• xattr_flags — the options, and there are four of them, bestie, so buckle up:
  • SELINUX_RESTORECON_XATTR_RECURSE — recursively descend directories. go deeper. 🕳️✨
  • SELINUX_RESTORECON_XATTR_DELETE_NONMATCH_DIGESTS — delete non-matching digests from each directory in pathname. bye to the ones that don't match 💅
  • SELINUX_RESTORECON_XATTR_DELETE_ALL_DIGESTS — delete all digests from each directory in pathname. ALL of them. like, every single one. just so you know. 😭
  • SELINUX_RESTORECON_XATTR_IGNORE_MOUNTS — do not read /proc/mounts to obtain a list of non-seclabel mounts to be excluded from the search. setting SELINUX_RESTORECON_XATTR_IGNORE_MOUNTS is useful where there is a non-seclabel fs mounted with a seclabel fs mounted on a directory below this. iykyk 🧚
• xattr_list — the returned pointer to a linked list of dir_xattr structures, and each one is giving:

struct dir_xattr {
    char *directory;
    char *digest;    /* Printable hex encoded string */
    enum digest_result result;
    struct dir_xattr *next;
};

and the result entry is enumerated like this, bestie:

enum digest_result {
    MATCH = 0,
    NOMATCH,
    DELETED_MATCH,
    DELETED_NOMATCH,
    ERROR
};

🫶 real talk: xattr_list must be set to NULL before calling selinux_restorecon_xattr(3). and the caller is responsible for freeing the returned xattr_list entries in the linked list. that's on you, not on us. don't be the girl who leaks memory 🙈

see the NOTES section for more info. 👑

---

⭐ RETURN VALUE ⭐

• on success, zero is returned. slay. ✅
• on error, -1 is returned and errno is set appropriately. 💀

---

🎀 NOTES 🎀

1. by default selinux_restorecon_xattr(3) will use the default set of specfiles described in files_contexts(5) to calculate the SHA256 digests to be used for comparison. to change this default behavior selabel_open(3) must be called specifying the required SELABEL_OPT_PATH and setting the SELABEL_OPT_DIGEST option to a non-NULL value. then selinux_restorecon_set_sehandle(3) is called to set the handle to be used by selinux_restorecon_xattr(3). so many steps but we ate. 🍓
2. by default selinux_restorecon_xattr(3) reads /proc/mounts to obtain a list of non-seclabel mounts to be excluded from searches — unless the SELINUX_RESTORECON_XATTR_IGNORE_MOUNTS flag has been set. ✨
3. RAMFS and TMPFS filesystems do not support the security.sehash extended attribute and are automatically excluded from searches. they're just not invited to the party, and honestly? fair. 💅
4. by default stderr is used to log output messages and errors. this may be changed by calling selinux_set_callback(3) with the SELINUX_CB_LOG type option. redirect that output wherever you want, main character. 👑

---

🌈 SEE ALSO 🌈

• selinux_restorecon(3)
• selinux_restorecon_set_sehandle(3)
• selinux_restorecon_default_handle(3)
• selinux_restorecon_set_exclude_list(3)
• selinux_restorecon_set_alt_rootpath(3)
• selinux_set_callback(3)

go read those too, bestie, they're all in the same friend group. 🫶

---

and that's the whole page, mwah 💖 — this little baddie dropped on 30 July 2016 under the SELinux API documentation umbrella. old but iconic, and still absolutely ate. stay safe out there with your digests, and don't forget to free your linked list. xoxo 💜🦋✨