removable_context(5)

💖 removable_context(5) 💖

okay so bestie, welcome to removable_context from the SELinux config collection — this is the little file that decides what label your USB stick, your SD card, your random thrifted flash drive gets when you plug it in. yes it's one line. yes it's iconic. let's go ✨

🌸 NAME 🌸

removable_context — the SELinux removable devices context configuration file 🎀

✨ DESCRIPTION ✨

so basically this file holds the default label that should be used for removable devices. that's it. that's the whole job. and honestly? she ate. 💅

selinux_removable_context_path(3) will hand you the active policy path to this file, in case you forgot where you left it (we've all been there 🫶).

the default removable context file is:

/etc/selinux/{SELINUXTYPE}/contexts/removable_context

and where does {SELINUXTYPE} come from, you ask? it's the entry from the selinux configuration file config (go peek at selinux_config(5), she explains everything 😌).

🦋 FILE FORMAT 🦋

the file is literally a single line entry, no cap. and it looks like this:

user:role:type[:range]

where:

• user, role, type, range — a user, role, type and optional range (for MCS/MLS) separated by colons (:) that will be applied to removable devices. the range part is optional bestie, she's just there for the MCS/MLS girlies 🌈

💀 EXAMPLE 💀

here's what it looks like irl:

# ./contexts/removable_contexts
system_u:object_r:removable_t:s0

look at that. clean. perfect. no notes. 🔥

👑 SEE ALSO 👑

• selinux(8)
• selinux_removable_context_path(3)
• selinux_config(5)

and that's the whole page bestie, you understood it on the first read because you're the main character 🧚

this was brought to you by Security Enhanced Linux, dated 28-Nov-2011 — yeah she's vintage but she still slays 💜