security_ismaclabel(9)
π β¨ security_ismaclabel β okay but is this xattr a MAC label or not
bestie. hi. this one's from the Kernel API Manual (section 9, so it's kernel-API girlies only, no syscall civilians π
) and it's genuinely one of the shortest little functions you will ever meet. she's a one-job icon and we love her for it π
πΈ NAME πΈ
security_ismaclabel β check if the named attribute is a MAC label β¨
π¦ SYNOPSIS π¦
int security_ismaclabel (const char *name );
π ARGUMENTS π
nameβ the full extended attribute name. not a nickname, not a vibe, the whole thing π«Ά
π DESCRIPTION π
so what she does is: check if the extended attribute specified by name represents a MAC label. that's it. that's the whole function. she looked at your xattr and went "hm. MAC label? possibly." π₯
β RETURN β
returns 1 if name is a MAC attribute, otherwise returns 0. no in-between, no "it depends", no situationship β just 1 or 0, periodt π
π SEE ALSO π
bestie I need you to sit down. the SEE ALSO on this page is enormous. she's giving main character energy with a whole friend group π«Ά the source of all this is the kernel file ./security/security.c, and then literally everyone shows up:
- the blob-allocating girlies:
lsm_file_alloc(9),lsm_backing_file_alloc(9),lsm_blob_alloc(9),lsm_cred_alloc(9),lsm_inode_alloc(9),lsm_task_alloc(9),lsm_ipc_alloc(9),lsm_key_alloc(9),lsm_msg_msg_alloc(9),lsm_bdev_alloc(9),lsm_bpf_map_alloc(9),lsm_bpf_prog_alloc(9),lsm_bpf_token_alloc(9),lsm_superblock_alloc(9)β and the one who fills your ctx for you,lsm_fill_user_ctx(9)β¨ - the binder + ptrace + capability crew:
security_binder_set_context_mgr(9),security_binder_transaction(9),security_binder_transfer_binder(9),security_binder_transfer_file(9),security_ptrace_access_check(9),security_ptrace_traceme(9),security_capget(9),security_capset(9),security_capable(9),security_quotactl(9),security_quota_on(9),security_syslog(9),security_settime64(9),security_vm_enough_memory_mm(9)π - the exec/bprm girlies doing their little credential handoff:
security_bprm_creds_for_exec(9),security_bprm_creds_from_file(9),security_bprm_check(9),security_bprm_committing_creds(9),security_bprm_committed_creds(9)π§ - the filesystem-context and superblock/mount icons:
security_fs_context_submount(9),security_fs_context_dup(9),security_fs_context_parse_param(9),security_sb_alloc(9),security_sb_delete(9),security_sb_free(9),security_free_mnt_opts(9),security_sb_eat_lsm_opts(9),security_sb_mnt_opts_compat(9),security_sb_remount(9),security_sb_kern_mount(9),security_sb_show_options(9),security_sb_statfs(9),security_sb_mount(9),security_sb_umount(9),security_sb_pivotroot(9),security_sb_set_mnt_opts(9),security_sb_clone_mnt_opts(9),security_move_mount(9)π¦ - the dentry/inode init besties:
security_path_notify(9),security_inode_alloc(9),security_inode_free(9),security_dentry_init_security(9),security_dentry_create_files_as(9),security_inode_init_security(9),security_inode_init_security_anon(9)πΈ - the entire
path_*friend group, all of them, no skips:security_path_mknod(9),security_path_post_mknod(9),security_path_mkdir(9),security_path_rmdir(9),security_path_unlink(9),security_path_symlink(9),security_path_link(9),security_path_rename(9),security_path_truncate(9),security_path_chmod(9),security_path_chown(9),security_path_chroot(9)π - the inode-operation girlies who do everything:
security_inode_create(9),security_inode_post_create_tmpfile(9),security_inode_link(9),security_inode_unlink(9),security_inode_symlink(9),security_inode_mkdir(9),security_inode_rmdir(9),security_inode_mknod(9),security_inode_rename(9),security_inode_readlink(9),security_inode_follow_link(9),security_inode_permission(9),security_inode_setattr(9),security_inode_post_setattr(9),security_inode_getattr(9),security_inode_setxattr(9),security_inode_set_acl(9),security_inode_post_set_acl(9),security_inode_get_acl(9),security_inode_remove_acl(9),security_inode_post_remove_acl(9),security_inode_post_setxattr(9),security_inode_getxattr(9),security_inode_listxattr(9),security_inode_removexattr(9),security_inode_post_removexattr(9)π₯ - the inode-adjacent deep lore squad:
security_inode_file_setattr(9),security_inode_file_getattr(9),security_inode_need_killpriv(9),security_inode_killpriv(9),security_inode_getsecurity(9),security_inode_setsecurity(9),security_inode_listsecurity(9),security_inode_getlsmprop(9),security_inode_copy_up(9),security_inode_copy_up_xattr(9),security_inode_setintegrity(9),security_kernfs_init_security(9)π - the file-struct crew, lowkey huge:
security_file_permission(9),security_file_alloc(9),security_file_release(9),security_file_free(9),security_backing_file_alloc(9),security_backing_file_free(9),security_file_ioctl(9),security_file_ioctl_compat(9),security_mmap_file(9),security_mmap_backing_file(9),security_mmap_addr(9),security_file_mprotect(9),security_file_lock(9),security_file_fcntl(9),security_file_set_fowner(9),security_file_send_sigiotask(9),security_file_receive(9),security_file_open(9),security_file_post_open(9),security_file_truncate(9)π - task + cred besties:
security_task_alloc(9),security_task_free(9),security_cred_alloc_blank(9),security_cred_free(9),security_prepare_creds(9),security_transfer_creds(9),security_cred_getsecid(9),security_cred_getlsmprop(9)π«Ά - the kernel-acting-as-you girlies:
security_kernel_act_as(9),security_kernel_create_files_as(9),security_kernel_module_request(9),security_kernel_read_file(9),security_kernel_post_read_file(9),security_kernel_load_data(9),security_kernel_post_load_data(9)β¨ - the task-attribute girlies (setuid setgid setgroups and the whole extended universe):
security_task_fix_setuid(9),security_task_fix_setgid(9),security_task_fix_setgroups(9),security_task_setpgid(9),security_task_getpgid(9),security_task_getsid(9),security_current_getlsmprop_subj(9),security_task_getlsmprop_obj(9),security_task_setnice(9),security_task_setioprio(9),security_task_getioprio(9),security_task_prlimit(9),security_task_setrlimit(9),security_task_setscheduler(9),security_task_getscheduler(9),security_task_movememory(9),security_task_kill(9),security_task_prctl(9),security_task_to_inode(9),security_create_user_ns(9)π - IPC permission + message queue crew:
security_ipc_permission(9),security_ipc_getlsmprop(9),security_msg_msg_alloc(9),security_msg_msg_free(9),security_msg_queue_alloc(9),security_msg_queue_free(9),security_msg_queue_associate(9),security_msg_queue_msgctl(9),security_msg_queue_msgsnd(9),security_msg_queue_msgrcv(9)π - shared memory + semaphores, they showed up too:
security_shm_alloc(9),security_shm_free(9),security_shm_associate(9),security_shm_shmctl(9),security_shm_shmat(9),security_sem_alloc(9),security_sem_free(9),security_sem_associate(9),security_sem_semctl(9),security_sem_semop(9), plussecurity_d_instantiate(9)π - the procattr / secctx icons:
security_getselfattr(9),security_setselfattr(9),security_getprocattr(9),security_setprocattr(9),security_secid_to_secctx(9),security_lsmprop_to_secctx(9),security_secctx_to_secid(9),security_release_secctx(9),security_inode_invalidate_secctx(9),security_inode_notifysecctx(9),security_inode_setsecctx(9),security_inode_getsecctx(9)β - notifications + keys + netlink:
security_post_notification(9),security_watch_key(9),security_netlink_send(9),security_unix_stream_connect(9),security_unix_may_send(9)π - socket girlies, the whole roster:
security_socket_create(9),security_socket_post_create(9),security_socket_socketpair(9),security_socket_bind(9),security_socket_connect(9),security_socket_listen(9),security_socket_accept(9),security_socket_sendmsg(9),security_socket_recvmsg(9),security_socket_getsockname(9),security_socket_getpeername(9),security_socket_getsockopt(9),security_socket_setsockopt(9),security_socket_shutdown(9),security_sock_rcv_skb(9),security_socket_getpeersec_stream(9),security_socket_getpeersec_dgram(9)π - sock allocations and flow classification:
lsm_sock_alloc(9),security_sk_alloc(9),security_sk_free(9),security_sk_clone(9),security_sk_classify_flow(9),security_req_classify_flow(9),security_sock_graft(9),security_inet_conn_request(9),security_inet_csk_clone(9),security_inet_conn_established(9)π¦ - secmark + tun devices:
security_secmark_relabel_packet(9),security_secmark_refcount_inc(9),security_secmark_refcount_dec(9),security_tun_dev_alloc_security(9),security_tun_dev_free_security(9),security_tun_dev_create(9),security_tun_dev_attach_queue(9),security_tun_dev_attach(9),security_tun_dev_open(9)π§ - sctp + mptcp + unix:
security_sctp_assoc_request(9),security_sctp_bind_connect(9),security_sctp_sk_clone(9),security_sctp_assoc_established(9),security_mptcp_add_subflow(9),security_unix_find(9)πΈ - infiniband besties:
security_ib_pkey_access(9),security_ib_endport_manage_subnet(9),security_ib_alloc_security(9),security_ib_free_security(9)π - the xfrm delegation:
security_xfrm_policy_alloc(9),security_xfrm_policy_clone(9),security_xfrm_policy_free(9),security_xfrm_policy_delete(9),security_xfrm_state_alloc(9),security_xfrm_state_alloc_acquire(9),security_xfrm_state_delete(9),security_xfrm_state_free(9),security_xfrm_policy_lookup(9),security_xfrm_state_pol_flow_match(9),security_xfrm_decode_session(9)π₯ - keyring icons:
security_key_alloc(9),security_key_free(9),security_key_permission(9),security_key_getsecurity(9),security_key_post_create_or_update(9)ποΈ - audit rule girlies:
security_audit_rule_init(9),security_audit_rule_known(9),security_audit_rule_free(9),security_audit_rule_match(9)π - bpf everything, she ate:
security_bpf(9),security_bpf_map(9),security_bpf_prog(9),security_bpf_map_create(9),security_bpf_prog_load(9),security_bpf_token_create(9),security_bpf_token_cmd(9),security_bpf_token_capable(9),security_bpf_map_free(9),security_bpf_prog_free(9),security_bpf_token_free(9)π - lockdown + block devices:
security_locked_down(9),security_bdev_alloc(9),security_bdev_free(9),security_bdev_setintegrity(9)π - perf events:
security_perf_event_open(9),security_perf_event_alloc(9),security_perf_event_free(9),security_perf_event_read(9),security_perf_event_write(9)π - and finally the io_uring crew + the initramfs one:
security_uring_override_creds(9),security_uring_sqpoll(9),security_uring_cmd(9),security_uring_allowed(9),security_initramfs_populated(9)π
like. that's the whole kernel security subsystem in one SEE ALSO. ngl, she said "come through, everyone" and everyone came π
okay that's the page!! mwah π this whole thing lives under the ./security tree, dated October 2026, and it's filed as security_ismaclabel(9) β go check your xattrs bestie, and remember: 1 means MAC attribute, 0 means she's just not that girl πβ¨
π¦ where this page comes from
- nixpkgs unstable: linux-manual 7.3.1
- π girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on : a language model's rewrite of the original, under its terms