selabel_media(5)

💖 selabel_media — the media contexts backend, explained bestie 💖

okay so this is the manual page for selabel_media(5), which lives in the SELinux API documentation family. it's the whole vibe of the userspace SELinux labeling interface and configuration file format for the media contexts backend. yes that's a mouthful, we'll break it down 🎀

---

✨ NAME ✨

selabel_media — the userspace SELinux labeling interface and configuration file format for the media contexts backend 🦋

---

✨ SYNOPSIS ✨

#include <selinux/label.h>

int selabel_lookup(struct selabel_handle *hnd,
                   char **context,
                   const char *device_name, int unused);

int selabel_lookup_raw(struct selabel_handle *hnd,
                   char **context,
                   const char *device_name, int unused);

two functions, same shape, one does a little extra magic. stay with me 💅

---

✨ DESCRIPTION ✨

so the media contexts backend is literally the thing that maps from media device names — think "cdrom" or "floppy" — into security contexts 🌸 it's what you use to find the right context for establishing context mounts on those devices. slay.

the context it hands back? you gotta free it with freecon(3), no leaving that lying around bestie 🫶

selabel_lookup(3) is where you go to read up on the function, plus its return codes and error codes. it's all there.

the integer lookup argument is currently unused and you should set it to zero. periodt.

any messages that selabel_lookup(3) generates get sent to stderr by default — but you can change that with selinux_set_callback(3). iconic.

selabel_lookup_raw(3) behaves identically to selabel_lookup(3), except it does not perform context translation. that's the whole difference, fr fr.

and the FILES section (scroll down 💖) has all the tea on the configuration files used to determine the media context.

---

✨ OPTIONS ✨

on top of the global options that selabel_open(3) already describes, this backend also recognizes the following:

• SELABEL_OPT_PATH — a non-null value for this option specifies a path to a file that will be opened in lieu of the standard media contexts file. so basically: "not that file, this file instead" 💅

---

✨ FILES ✨

which media context file gets used to retrieve a default context depends on the SELABEL_OPT_PATH parameter you passed to selabel_open(3). here's the breakdown:

• if it's NULL, then the SELABEL_OPT_PATH value defaults to the active policy media contexts location — the one returned by selinux_media_context_path(3) 🦋
• otherwise, the actual SELABEL_OPT_PATH value you specified is what gets used. you said it, we use it.

the default media contexts file is:

/etc/selinux/{SELINUXTYPE}/contexts/files/media

where {SELINUXTYPE} is the entry from the selinux configuration file config — see selinux_config(5) if you need it 👑

---

✨ FILE FORMAT ✨

every single line inside the media file looks like this:

device_name context

and here's what each piece means:

• device_name — the media identifier (e.g. cdrom, floppy, disk and usb).
• context — the context to be used for labeling the device.

example, because examples eat every time 🍓:

# contexts/files/media
cdrom system_u:object_r:removable_device_t
floppy system_u:object_r:removable_device_t
disk system_u:object_r:fixed_disk_device_t

---

✨ NOTES ✨

if you want contexts to be validated, then the global option SELABEL_OPT_VALIDATE must be set before calling selabel_open(3). if it's not set, then it is possible for an invalid context to be returned 😭 so like. set it. please.

---

✨ SEE ALSO ✨

selinux(8), selabel_open(3), selabel_lookup(3), selabel_stats(3), selabel_close(3), selinux_set_callback(3), selinux_media_context_path(3), freecon(3), selinux_config(5)

---

and that's the whole page, bestie — go forth and label your media devices correctly 💜✨

this was brought to you by the Security Enhanced Linux girlies, dated 29 Nov 2011, which lowkey means this page is older than most of us and still serving main character energy 👑 no cap. mwah 💅