failsafe_context(5)

💖 failsafe_context(5) 💖

okay so bestie, welcome to the manual page for failsafe_context — it's a (5) page, which means it's about a config file, and it lives in the SELinux configuration section of the man pages. no cap, this one's short but it's lowkey a hero.

✨ NAME ✨

failsafe_context — the SELinux fail safe context configuration file. it's giving "backup plan but make it a whole file" 🫶

🌸 DESCRIPTION 🌸

the failsafe_context file lets SELinux-aware applications — think PAM(8) — grab a known valid login context for an administrator, but only if no valid default entries can be found anywhere else. it's the emergency snack in the back of the pantry. the moment you need it, you're so glad it's there. 🍓

selinux_failsafe_context_path(3) will return the active policy path to this file. the default failsafe context file is:

/etc/selinux/{SELINUXTYPE}/contexts/failsafe_context

where {SELINUXTYPE} is the entry from the selinux configuration file config (see selinux_config(5)). iykyk 💅

the following functions read this file from the active policy path if they cannot obtain a default context:

• get_default_context(3)
• get_ordered_context_list(3)
• get_ordered_context_list_with_level(3)
• get_default_context_with_level(3)
• get_default_context_with_role(3)
• get_default_context_with_rolelevel(3)
• query_user_context(3)
• manual_user_enter_context(3)

like, all eight of them. they all come running to this file when things go sideways. iconic behaviour honestly. 👑

🎀 FILE FORMAT 🎀

the file consists of a single line entry, and it goes a lil something like this:

role:type[:range]

where:

• role, type, range — a role, a type, and an optional range (for MCS/MLS), separated by colons (:) to form a valid login process context so an administrator can access the system. that's it. one line. one vibe. ✨

heads up bestie: it really is a single line. don't go writing a novel in there, the format is role:type[:range] and that's the whole story. 🙈

🌈 EXAMPLE 🌈

# ./contexts/failsafe_context
unconfined_r:unconfined_t:s0

look at her. one line. perfect. no notes. 💜

🦋 SEE ALSO 🦋

• selinux(8)
• selinux_failsafe_context_path(3)
• PAM(8)
• selinux_default_type_path(3)
• get_default_context(3)
• get_ordered_context_list(3)
• get_ordered_context_list_with_level(3)
• get_default_context_with_level(3)
• get_default_context_with_role(3)
• get_default_context_with_rolelevel(3)
• query_user_context(3)
• manual_user_enter_context(3)
• selinux_config(5)

and that's the whole page, bestie!! this one came from Security Enhanced Linux, dated 28-Nov-2011, and it's filed under failsafe_context(5). go forth and never get locked out of your own system, mwah 💋✨

stay safe out there, admin 💖