getexeccon(3)

✨ getexeccon — the SELinux exec-context page 💅

okay bestie so this is from the SELinux API documentation set, and it's giving "how do I tell the kernel what security context my next exec should wear" energy. three main characters in this one: getexeccon, setexeccon, and rpm_execcon (plus their raw cousins and one little helper-setter). let's GO 🦋

---

🌸 NAME 🌸

getexeccon, setexeccon — grab or set the SELinux security context that gets used when you execute a new process 👑

rpm_execcon — run a helper for rpm in an appropriate security context 🎀

---

🧚 SYNOPSIS 🧚

#include <selinux/selinux.h>

int getexeccon(char **context);

int getexeccon_raw(char **context);

int setexeccon(const char *context);

int setexeccon_raw(const char *context);

int setexecfilecon(const char *filename, const char *fallback_type);

int rpm_execcon(unsigned int verified, const char *filename, char *const
argv[] , char *const envp[]);

---

💖 DESCRIPTION 💖

getexeccon() retrieves the context used for executing a new process. if the thing it hands back is non-NULL, you gotta free it with freecon(3) — no leaking, bestie, that's not the vibe 🌸. and if the program never explicitly set an exec context (i.e. it's just rolling with the default policy behavior), getexeccon() sets *context to NULL. iconic, honestly.

setexeccon() sets the context that's used for the next execve(2) call. you can pass NULL to setexeccon() to reset back to the default policy behavior 🫶. and here's the cute part — the exec context is automatically reset after the next execve(2), so a program doesn't need to explicitly sanitize it upon startup. the cleanup is built in. slay 💅.

setexeccon() can also be applied before library functions that internally perform an execve(2) — like execl*(3), execv*(3), popen(3) — so you can set an exec context for that operation too. no cap, it works for those 🦋.

getexeccon_raw() and setexeccon_raw() behave identically to their non-raw counterparts, except they do not perform context translation. that's the whole difference. fr fr.

⚠️ Note, and this one matters: signal handlers that perform an execve(2) must take care to save, reset, and restore the exec context to avoid unexpected behavior. like, genuinely. save it, reset it, put it back. don't skip steps 😭

setexecfilecon() sets the context used for the next execve(2) call, based on the policy for the filename, and falls back to a new context with a fallback_type in case there is no transition. it's giving "policy first, fallback as backup" 💜.

rpm_execcon() is deprecated — please use setexecfilecon() in conjunction with execve(2) in all new code, okay? this one runs a helper for rpm in an appropriate security context. the verified parameter should contain the return code from the signature verification, and those codes are:

• 0 == ok
• 1 == notfound
• 2 == verifyfail
• 3 == nottrusted
• 4 == nokey

...although this information is not yet used by the function. 🙈 so like, pass it correctly anyway, but know it's currently just sitting there. the function determines the proper security context for the helper based on policy, sets the exec context accordingly, and then executes the specified filename with the provided argument and environment arrays. main character behavior, honestly 👑.

---

⭐ RETURN VALUE ⭐

on failure, -1 is returned and errno is set appropriately. classic 😭.

on success, getexeccon(), setexeccon() and setexecfilecon() return 0 🎀.

rpm_execcon() only returns upon errors, because it calls execve(2) — like, if it succeeds it's not coming back to tell you about it. it's gone. it's living its life now 💀.

---

🌈 SEE ALSO 🌈

selinux(8), freecon(3), getcon(3)

---

this page was brought to you by russell@coker.com.au, dated 1 January 2004 — the SELinux API documentation era, and we're still obsessed with it 💖✨