secolor.conf(8)

💖 secolor.conf — the SELinux color configuration file 💖

okay bestie, sit down, hydrate, and let me tell you about secolor.conf from the System Manager's Manual. it's giving "make your SELinux contexts pretty" and honestly? iconic. ✨

---

🌈 NAME 🌈

secolor.conf — the SELinux color configuration file. that's it, that's the whole name, she's simple and she knows it 💅

---

🦋 DESCRIPTION 🦋

so. the file at /etc/selinux/{SELINUXTYPE}/secolor.conf is the configuation file (yes that typo is in the original, we're keeping her, she's part of the family now 🫶) that controls the color that gets associated to the context components associated to the raw context passed by selinux_raw_context_to_color(3) — that's when context related info is gonna be displayed in color by an SELinux-aware application.

and like, where does selinux_raw_context_to_color(3) even get this color info? from the active policy secolor.conf file, as returned by selinux_colors_path(3). no cap, that's the whole pipeline. 🔥

---

🎀 FILE FORMAT 🎀

the file format is literally this:

color color_name = #color_mask
[...]

context_component string = fg_color_name bg_color_name
[...]

and now the deets, one by one, because we do not skip:

• color — the color keyword. each color entry is on a new line, bestie. one per line. no crowding. ✨
• color_name — a single word name for the color (e.g. red).
• color_mask — a color mask starting with a hash (#) that describes the hexadecimal RGB colors, with black being #000000 and white being #ffffff. she's hex, she's precise, she ate. 💅
• context_component — the context component name, and it must be one of the following:
  • user, role, type or range
  • each context_component string ... entry goes on a new line.
• string — this is the context_component string that will be matched with the raw context component passed by selinux_raw_context_to_color(3).

a wildcard '*' may be used to match any undefined string for the user, role and type context_component entries only. so don't go trying it on range, she said what she said. 🙈

• fg_color_name — the color_name string that will be used as the foreground color. a color_mask may also be used, so you have options, main character energy. 👑
• bg_color_name — the color_name string that will be used as the background color. a color_mask may also be used here too. 💜

---

🌸 EXAMPLES 🌸

✨ Example 1 entries are:

color black  = #000000
color green  = #008000
color yellow = #ffff00
color blue   = #0000ff
color white  = #ffffff
color red    = #ff0000
color orange = #ffa500
color tan    = #D2B48C

user * = black white
role * = white black
type * = tan orange
range s0-s0:c0.c1023 = black green
range s1-s1:c0.c1023 = white green
range s3-s3:c0.c1023 = black tan
range s5-s5:c0.c1023 = white blue
range s7-s7:c0.c1023 = black red
range s9-s9:c0.c1023 = black orange
range s15:c0.c1023   = black yellow

look at those ranges, one per line, living their best lives. ✨

✨ Example 2 entries are:

color black  = #000000
color green  = #008000
color yellow = #ffff00
color blue   = #0000ff
color white  = #ffffff
color red    = #ff0000
color orange = #ffa500
color tan    = #d2b48c

user unconfined_u = #ff0000 green
role unconfined_r = red #ffffff
type unconfined_t = red orange
user user_u       = black green
role user_r       = white black
type user_t       = tan red
user xguest_u     = black yellow
role xguest_r     = black red
type xguest_t     = black green
user sysadm_u     = white black
range s0:c0.c1023 = black white
user *            = black white
role *            = black white
type *            = black white

notice how example 2 mixes color_name and color_mask in the same line? yeah. she's flexible like that. and yeah, tan is lowercase #d2b48c here vs #D2B48C in example 1 — both are exactly as written, don't @ me, hex doesn't care about your capitalization vibes. 💀

---

🔥 SEE ALSO 🔥

• mcstransd(8)
• selinux_raw_context_to_color(3)
• selinux_colors_path(3)

go read those too, they're the supporting cast and they deserve their flowers. 🌺

---

and that's the whole page, bestie!! this was the SELinux API documentation, dated 08 April 2011 — yeah she's an elder but she's still serving. go forth and color your contexts, ily, bye!! 💖✨🎀🦋🌸💅🫶