getsockcreatecon(3)

💖 getsockcreatecon — get or set the SELinux security context used for creating new labeled sockets 💖

okay bestie, welcome to getsockcreatecon(3) from the SELinux API docs, she's niche but she's iconic ✨ this page covers getsockcreatecon, setsockcreatecon and their raw twins. no cap, it's giving "tiny API, big responsibility". let's get into it 🫶

✨ SYNOPSIS ✨

#include <selinux/selinux.h>

int getsockcreatecon(char **con);

int getsockcreatecon_raw(char **con);

int setsockcreatecon(const char *context);

int setsockcreatecon_raw(const char *context);

🌸 DESCRIPTION 🌸

so getsockcreatecon() is the lil gossip girl of this duo — she retrieves the context that's used for creating a new labeled network socket. 💅

if the returned context is non-NULL, you gotta free it with freecon(3). and here's the tea: getsockcreatecon() sets *con to NULL if no sockcreate context has been explicitly set by the program (meaning it's just vibing with the default policy behavior). so NULL is not a bug, it's a whole mood 🎀

setsockcreatecon() is the one doing the setting — she sets the context used for creating new labeled network sockets. and yes, you can pass NULL to setsockcreatecon() to reset back to the default policy behavior. no drama, just a clean slate ✨

and listen, the sockcreate context is automatically reset after the next execve(2), so your program doesn't have to explicitly sanitize it on startup. she cleans up after herself, main character energy fr fr 👑

setsockcreatecon() can also be applied prior to library functions that internally perform a file creation, in order to set a file context on the objects. lowkey powerful 🦋

getsockcreatecon_raw() and setsockcreatecon_raw() behave identically to their non-raw counterparts, except they do not perform context translation. same girl, no translator 💜

⚠️ Note: signal handlers that perform a setsockcreatecon() must take care to save, reset, and restore the sockcreate context, otherwise you get unexpected behavior. do not skip this step bestie, it WILL bite 😭

⚠️ Note: contexts are thread specific. so like, one thread's context is not another thread's context, periodt 🌈

⭐ RETURN VALUE ⭐

• on error, -1 is returned 💀
• on success, 0 is returned 🎉

🦋 SEE ALSO 🦋

• selinux(8)
• freecon(3)
• getcon(3)

and that's the whole page, bestie!! 💖 this gem was written by dwalsh@redhat.com on 24 September 2008, and it's getsockcreatecon(3) out of the SELinux API documentation. she's been slaying since '08 and she's still relevant. obsessed 🫶✨💅