selabel_x(5)

💖 selabel_x — the manual page, but make it cute 💖

okay so bestie, welcome to selabel_x, which lives in section 5 of the SELinux API documentation. She's a manual page, she's a whole vibe, and she's about the X Window System contexts backend. Buckle up 🎀

---

✨ NAME ✨

selabel_x — the userspace SELinux labeling interface and configuration file format for the X Window System contexts backend. Not only that, this backend is also used to figure out the default context for labeling remotely connected X clients. Yes she does it all, main character energy fr fr 👑

---

🌸 SYNOPSIS 🌸

#include <selinux/label.h>

int selabel_lookup(struct selabel_handle *hnd,
                   char **context,
                   const char *object_name, int object_type);

int selabel_lookup_raw(struct selabel_handle *hnd,
                   char **context,
                   const char *object_name, int object_type);

literally just include the header and you're in 💅

---

🦋 DESCRIPTION 🦋

So the X contexts backend maps from X Window System object names → security contexts. That's it, that's the job 🫶 It's used to find the appropriate context for X Window System objects whose significance and/or usage semantics are determined primarily by name. The context it hands back? You gotta free it with freecon(3), no leaving it lying around like yesterday's iced coffee 😭

selabel_lookup(3) is the one that describes the function along with its return and error codes. Go read her too.

This backend is also used to determine the default context for labeling remotely connected X clients. (Yes, mentioned twice, because it matters.)

The object_type argument should be set to one of these, no exceptions bestie:

• SELABEL_X_PROP — the object_name argument specifies the name of a window property, such as "WM_NAME".
• SELABEL_X_SELN — the object_name argument specifies the name of a selection, such as "PRIMARY".
• SELABEL_X_EXT — the object_name argument specifies the name of a protocol extension, such as "RENDER".
• SELABEL_X_EVENT — the object_name argument specifies the name of an event type, such as "X11:ButtonPress".
• SELABEL_X_CLIENT — the object_name argument is ignored, however it should be set to either * (an asterisk or 'wildcard' that will select the default entry) or a specific entry such as "remote" in the X contexts file, as shown in the EXAMPLE section. The default context for labeling remote X clients is then returned.
• SELABEL_X_POLYPROP — like SELABEL_X_PROP, but checks if the property was marked as being polyinstantiated. See NOTES below.
• SELABEL_X_POLYSELN — like SELABEL_X_SELN, but checks if the selection was marked as being polyinstantiated. See NOTES below.

Any messages generated by selabel_lookup(3) get sent to stderr by default, though you can change that with selinux_set_callback(3). Slay, configurable ✨

selabel_lookup_raw behaves identically to selabel_lookup but does not perform context translation. Important distinction, don't skip it 💀

The FILES section details the configuration files used to determine the X object context. Keep scrolling, she's down there 🌈

---

💅 OPTIONS 💅

On top of the global options described in selabel_open(3), this backend recognizes the following option:

• SELABEL_OPT_PATH — a non-null value for this option specifies a path to a file that will be opened in lieu of the standard X contexts file (see the FILES section for details).

That's the whole list. Short but iconic 🎀

---

🍓 FILES 🍓

The X context file used to retrieve a default context depends on the SELABEL_OPT_PATH parameter passed to selabel_open(3). If it's NULL, then the SELABEL_OPT_PATH value will default to the active policy X contexts location (as returned by selinux_x_context_path(3)), otherwise the actual SELABEL_OPT_PATH value specified is used. Simple as that bestie 🫶

The default X object contexts file is:

/etc/selinux/{SELINUXTYPE}/contexts/x_contexts

Where {SELINUXTYPE} is the entry from the selinux configuration file config (see selinux_config(5)). iykyk 📁

The entries within the X contexts file are shown in the Object Name String Values and FILE FORMAT sections. Let's go 👇

🌟 Object Name String Values 🌟

The string name assigned to each object_type argument that can be present in the X contexts file are:

• SELABEL_X_PROP → property
• SELABEL_X_SELN → selection
• SELABEL_X_EXT → extension
• SELABEL_X_EVENT → event
• SELABEL_X_CLIENT → client
• SELABEL_X_POLYPROP → poly_property
• SELABEL_X_POLYSELN → poly_selection

memorize these, they're the whole cheat code 🔥

---

🌈 FILE FORMAT 🌈

Each line within the X contexts file looks like this:

object_type object_name context

Where:

• object_type — this is the string representation of the object type shown in the Object Name String Values section. There can be multiple lines with the same object_type string, and they'll form a block of entries (each one with a different object_name entry).
• object_name — these are the object names of the specific X-server resource, such as PRIMARY, CUT_BUFFER0 etc. They're generally defined in the X-server source code (protocol.txt and BuiltInAtoms in the dix directory of the xorg-server source package). The entry can contain '*' for wildcard matching or '?' for substitution. Note that if the '*' is used, then be aware that the order of entries in the file is important. The '*' on its own is used to ensure a default fallback context is assigned and should be the last entry in the object_type block.
• context — the security context that will be applied to the object.

Example 1:

# object_type  object_name  context
selection      PRIMARY      system_u:object_r:clipboard_xselection_t:s0
selection      *            system_u:object_r:xselection_t:s0

Example 2 — this example shows how a client entry can be configured to ensure an entry is always found:

# object_type  object_name  context
client         *            system_u:object_r:remote_t:s0

see how the wildcard eats last? yeah. that's the move 💅

---

👑 NOTES 👑

1. Properties and selections are marked as either polyinstantiated or not. For these name types, the "POLY" option searches only the names marked as being polyinstantiated, while the other option searches only the names marked as not being polyinstantiated. Users of the interface should check both mappings, optionally taking action based on the result (e.g. polyinstantiating the object).
2. If contexts are to be validated, then the global option SELABEL_OPT_VALIDATE must be set before calling selabel_open(3). If this is not set, then it is possible for an invalid context to be returned. Not a drill bestie, set the flag 😭

---

🔥 SEE ALSO 🔥

selinux(8), selabel_open(3), selabel_lookup(3), selabel_stats(3), selabel_close(3), selinux_set_callback(3), selinux_x_context_path(3), freecon(3), selinux_config(5)

go read all of them, they're the friend group 🫶

---

Security Enhanced Linux · 29 Nov 2011 · selabel_x(5)

and that's the whole page bestie 💖 she's from the Security Enhanced Linux era, dated 29 Nov 2011, and she lives at selabel_x(5). go forth and label your X objects, periodt ✨🎀🦋