sestatus.conf(5)

💅 sestatus.conf — the sestatus configuration file, bestie

okay so real talk, this is sestatus.conf(5), which is the config file for sestatus(8). It's the little vibe-check list that tells sestatus whose security context you're nosy about. She's small, she's optional, she's iconic. 🎀

✨ NAME ✨

sestatus.conf — the sestatus(8) configuration file, periodt. 💖

🌸 DESCRIPTION 🌸

So the sestatus.conf file is what the sestatus(8) command reads when you hit it with the -v option — and it's literally the thing that decides what file and process security contexts should be displayed. That's it. That's the whole job. 👑

The fully qualified path name of the configuration file is:

Now listen, the file is made of two optional sections (the deets are down in **FILE FORMAT**, keep scrolling bestie). But here's the tea: whether those sections exist or not, these three things are **always** going to show up, no cap:

- The current process context
- The init process context
- The controlling terminal file context

So even if you write an empty file, she still serves. ✨

---

# 🦋 FILE FORMAT 🦋

The format consists of two optional sections, and it goes a little something like this:

[files] file_name [file_name] ...

[process] executable_file_name [executable_file_name] ...

Where, and I'm gonna break it all the way down:

- **`[files]`** — the start of the file list block. This is the opening curtain. 🎬
- *`file_name`* — one or more fully qualified file names, each on a new line, and each one will have its context displayed. If the file does not exist, then it is ignored (she's unbothered, she's at peace 🙈). If the file is a symbolic link, then `sestatus -v` will **also** display the target file context. Symlinks getting a whole extra moment, as they deserve. 💅
- **`[process]`** — the start of the process list block.
- *`executable_file_name`* — one or more fully qualified executable file names that, should it be an active process, have its context displayed. Each entry is on a new line. So like, if it's running, you'll see it. If it's not, well. 😭

> heads up: it's *fully qualified* file names both times — no shortcuts, no relative paths, no "it's somewhere in my home directory trust me". full path or nothing bestie 🫶

---

# 🌈 EXAMPLE 🌈

Here's what she looks like in the wild, copy-paste energy, no edits:

/etc/sestatus.conf

[files] /etc/passwd /etc/shadow /bin/bash /bin/login /lib/libc.so.6 /lib/ld-linux.so.2 /lib/ld.so.1

[process] /sbin/mingetty /sbin/agetty /usr/sbin/sshd

Look at those absolute paths. Every single one. Chef's kiss. 👨‍🍳💋

---

# 👀 SEE ALSO 👀

- `selinux(8)`
- `sestatus(8)`

go read `sestatus(8)` for real, that's where the `-v` magic actually lives. iykyk. 🔥

---

okay that's the whole page, bestie, you ate that 🍓

this one came from **Security Enhanced Linux**, dated **26-Nov-2011** — yeah she's an elder but she's still slaying, and honestly? respect the longevity. 💜👑