selinux_netlbl_err(9)

✨ selinux_netlbl_err(9) ✨

okay so this function is literally called selinux_netlbl_err and its whole job is handling NetLabel packet errors. it's giving "kernel API manual" energy and i'm obsessed. this function is in the 9 section which means it's a kernel API function, and honestly? iconic behavior.

🌸 SYNOPSIS 🌸

here's the signature, bestie. don't touch the syntax or it will absolutely not slay:

void selinux_netlbl_err (struct sk_buff *skb , u16 family , int error ,
       int gateway );

💖 ARGUMENTS 💖

• skb — this is literally the packet. the whole packet. nothing more, nothing less. it's a struct sk_buff * pointing at the packet in question.
• family — the packet's address family, typed as a u16. that's the vibe check for whether this is IPv4, IPv6, or whatever else.
• error — the error code itself, passed as an int. like the what-went-wrong code.
• gateway — lowkey just a boolean: true if the host is acting as a gateway, false if it's not. that's it. no cap.

🦋 DESCRIPTION 🦋

so here's the tea: when a packet gets dropped because of a call to avc_has_perm, you pass that error code straight to the NetLabel subsystem so any protocol specific processing can get done. that's the entire point. that's the assignment.

the way this is totally safe to call even if you're not sure NetLabel labeling is present on the packet? yes. NetLabel is smart enough to only act when it should, so you don't have to do any extra checking first. it literally handles the vibe check for you. 💅

ngl this is one of those "just call it and let it cook" situations — no extra conditions needed on your end.

🎀 SEE ALSO 🎀

like, if you wanna go deeper (and honestly same), check out these:

• the kernel file ./security/selinux/netlabel.c — iconic source location
• selinux_netlbl_sidlookup_cached(9)
• selinux_netlbl_sock_genattr(9)
• selinux_netlbl_sock_getattr(9)
• selinux_netlbl_cache_invalidate(9)
• selinux_netlbl_sk_security_free(9)
• selinux_netlbl_sk_security_reset(9)
• selinux_netlbl_skbuff_getsid(9)
• selinux_netlbl_skbuff_setsid(9)
• selinux_netlbl_sctp_assoc_request(9)
• selinux_netlbl_inet_conn_request(9)
• selinux_netlbl_inet_csk_clone(9)
• selinux_netlbl_sctp_sk_clone(9)
• selinux_netlbl_socket_post_create(9)
• selinux_netlbl_sock_rcv_skb(9)
• selinux_netlbl_option(9)
• selinux_netlbl_socket_setsockopt(9)
• selinux_netlbl_socket_connect_helper(9)
• selinux_netlbl_socket_connect_locked(9)
• selinux_netlbl_socket_connect(9)

that's the whole vibe check, bestie! this page is from the kernel API manual, sourced from ./security/selinux, and it's dated October 2026. go forth and handle those NetLabel packet errors with main character energy. bye bestie 💜✨