secolor.conf(5)

💖 secolor.conf — the SELinux color config file 💖

okay bestie, welcome to secolor.conf(5), the optional file that decides what colors your SELinux contexts get when some SELinux-aware app wants to show context info all pretty. it's giving aesthetic, it's giving rgb, it's giving "why is my terminal suddenly a rainbow". let's go 🎀

✨ NAME ✨

secolor.conf — the SELinux color configuration file 💅

🌸 DESCRIPTION 🌸

so like. this file is optional (yes, optional, you don't have to, but why wouldn't you). it controls the color that gets associated to the context components that come along with the raw context passed in by selinux_raw_context_to_color(3) — that's the function that kicks in when context-related info is gonna be displayed in color by an SELinux-aware application.

and where does selinux_raw_context_to_color(3) get this color info from? from the active policy secolor.conf file, as returned by selinux_colors_path(3). yes bestie, it's a whole little pipeline. slay. 🔥

🦋 FILE FORMAT 🦋

okay here's the whole vibe, the file format is literally this:

color color_name = #color_mask
[...]

context_component string = fg_color_name bg_color_name
[...]

and now the breakdown, one by one, no skipping, i promised 🫶

• color — the color keyword. every single color entry goes on a new line. one per line, no crowding.
• color_name — a single word name for the color (like, red. iconic).
• color_mask — a color mask that starts with a hash (#) and describes the hexadecimal RGB colors. black is #000000 and white is #ffffff. those two are your anchors, remember them.
• context_component — the context component name, and it must be one of these four, no other options bestie:
  • user
  • role
  • type
  • range

and each context_component string ... entry gets its own new line too.

• string — this is the context_component string that gets matched against the raw context component passed by selinux_raw_context_to_color(3).

heads up: a wildcard '*' may be used to match any undefined string — but only for the user, role and type context_component entries. that's it. nowhere else. don't try it. 😭

• fg_color_name — the color_name string that'll be used as the foreground color. a color_mask may also be used here, so you're not locked to named colors.
• bg_color_name — the color_name string that'll be used as the background color. and yep, a color_mask may also be used here too.

🌈 EXAMPLES 🌈

Example 1 ✨

Example 1 entries are:

color black  = #000000
color green  = #008000
color yellow = #ffff00
color blue   = #0000ff
color white  = #ffffff
color red    = #ff0000
color orange = #ffa500
color tan    = #D2B48C

user * = black white
role * = white black
type * = tan orange
range s0-s0:c0.c1023 = black green
range s1-s1:c0.c1023 = white green
range s3-s3:c0.c1023 = black tan
range s5-s5:c0.c1023 = white blue
range s7-s7:c0.c1023 = black red
range s9-s9:c0.c1023 = black orange
range s15-s15:c0.c1023   = black yellow

(and yes bestie, #D2B48C is capital-D capital-B-C in this one. lowercase shows up in example 2. they're both exactly as written, i don't make the rules, i just transcribe them 💖)

Example 2 🌸

Example 2 entries are:

color black  = #000000
color green  = #008000
color yellow = #ffff00
color blue   = #0000ff
color white  = #ffffff
color red    = #ff0000
color orange = #ffa500
color tan    = #d2b48c

user unconfined_u = #ff0000 green
role unconfined_r = red #ffffff
type unconfined_t = red orange
user user_u       = black green
role user_r       = white black
type user_t       = tan red
user xguest_u     = black yellow
role xguest_r     = black red
type xguest_t     = black green
user sysadm_u     = white black
range s0-s0:c0.c1023 = black white
user *            = black white
role *            = black white
type *            = black white

see how the fg_color_name and bg_color_name slots can take either a name or a raw #color_mask? user unconfined_u = #ff0000 green is doing exactly that. main character energy. 👑

💜 SEE ALSO 💜

selinux(8), selinux_raw_context_to_color(3), selinux_colors_path(3)

and that's the whole page, bestie!! 🫶 this was the SELinux API documentation, dated 08 April 2011 — so yes it's vintage, and yes it still eats. go forth and color your contexts. periodt. 💅✨