getkeycreatecon(3)

💖 getkeycreatecon — the SELinux API docs, but make it a group chat 💖

okay bestie, so you're reading the getkeycreatecon(3) page from the SELinux API documentation, and honestly? it's giving "small but mighty." two little functions, one big job: getting and setting the security context that gets slapped onto a brand new kernel keyring. no cap.

---

✨ NAME ✨

getkeycreatecon, setkeycreatecon — get or set the SELinux security context used for creating a new kernel keyrings 🎀

ngl the original says "a new kernel keyrings" and I'm not fixing it. that's canon. leave her alone. 💅

---

🦋 SYNOPSIS 🦋

#include <selinux/selinux.h>

int getkeycreatecon(char **con);

int getkeycreatecon_raw(char **con);

int setkeycreatecon(const char *context);

int setkeycreatecon_raw(const char *context);

four functions, one header, zero drama. let's gooo 🌸

---

💜 DESCRIPTION 💜

so getkeycreatecon() does the cute little retrieval thing: it grabs the context that's used for creating a new kernel keyring. 🗝️

if what you get back is non-NULL, bestie, you gotta free it with freecon(3). don't just leave it lying around like an unread text. 💀

and here's the lil plot twist: getkeycreatecon() sets *con to NULL if no keycreate context has been explicitly set by the program — like, i.e. when you're just running on the default policy behavior. nothing set, nothing returned, NULL it is. periodt.

---

setkeycreatecon() is the setter of the duo — it sets the context used for creating a new kernel keyring. ✨

you can pass NULL to setkeycreatecon() to reset back to the default policy behavior. like a factory reset but for your context, iconic.

and this is the part that lowkey saves you: the keycreate context is automatically reset after the next execve(2). so a program doesn't need to explicitly sanitize it upon startup. she cleans up after herself. we love a self-sufficient queen. 👑

---

also — and this is such a useful vibe — setkeycreatecon() can be applied prior to library functions that internally perform an file creation, in order to set an file context on the objects. (yes, "an file." keeping it exactly as the ancestors wrote it, iykyk 🫶)

---

getkeycreatecon_raw() and setkeycreatecon_raw() behave identically to their non-raw counterparts, but they do not perform context translation. that's it. that's the difference. raw is just raw. 🧚

---

Note: Signal handlers that perform a setkeycreatecon() must take care to save, reset, and restore the keycreate context to avoid unexpected behavior. 😭 like please, save your state, bestie. don't rawdog a signal handler and then act surprised.

Note: Contexts are thread specific. 🧵 so don't go assuming your fave context is shared across threads, because she is NOT.

---

⭐ RETURN VALUE ⭐

• On error, -1 is returned. 💀
• On success, 0 is returned. 🎉

that's it. no middle ground. she's binary and she's thriving.

---

🌈 SEE ALSO 🌈

• selinux(8)
• freecon(3)
• getcon(3)
• getexeccon(3)

go read your siblings, they're all part of the same iconic family. 👑

---

okay that's the whole page, you're officially educated 💖 this lil masterpiece was brought to you by dwalsh@redhat.com, dated 9 September 2008 — a true vintage banger that still slays today. 🎀✨