selinux_netl...t_setsockopt(9)

💅 selinux_netlbl_socket_setsockopt(9) 💅

okay so welcome to the Kernel API Manual, bestie — today’s main character is the page selinux_netl...t_setsockopt(9), and the function underneath is selinux_netlbl_socket_setsockopt. The header is out here doing its little truncated-name moment, but we move. ✨

---

🌸 NAME 🌸

selinux_netlbl_socket_setsockopt — do not allow users to remove a NetLabel. That’s literally the whole vibe.

---

✨ SYNOPSIS ✨

int selinux_netlbl_socket_setsockopt (struct socket *sock , int level ,
       int optname );

---

🫶 ARGUMENTS 🫶

• sock — the socket.
• level — the socket level or protocol.
• optname — the socket option name.

---

💅 DESCRIPTION 💅

okay so this one checks the setsockopt call. If the user is trying to replace the IP options on a socket and a NetLabel is in place for the socket, it denies the access; otherwise it allows the access.

It returns zero when the access is allowed, -EACCES when denied, and other negative values on error. no cap, that’s the whole return situation. 🫶

---

🔥 SEE ALSO 🔥

Kernel file: ./security/selinux/netlabel.c

• selinux_netlbl_sidlookup_cached(9)
• selinux_netlbl_sock_genattr(9)
• selinux_netlbl_sock_getattr(9)
• selinux_netlbl_cache_invalidate(9)
• selinux_netlbl_err(9)
• selinux_netlbl_sk_security_free(9)
• selinux_netlbl_sk_security_reset(9)
• selinux_netlbl_skbuff_getsid(9)
• selinux_netlbl_skbuff_setsid(9)
• selinux_netlbl_sctp_assoc_request(9)
• selinux_netlbl_inet_conn_request(9)
• selinux_netlbl_inet_csk_clone(9)
• selinux_netlbl_sctp_sk_clone(9)
• selinux_netlbl_socket_post_create(9)
• selinux_netlbl_sock_rcv_skb(9)
• selinux_netlbl_option(9)
• selinux_netlbl_socket_connect_helper(9)
• selinux_netlbl_socket_connect_locked(9)
• selinux_netlbl_socket_connect(9)

---

okay that’s the whole page, bestie 🎀 this one’s from ./security/selinux, dated October 2026, and the footer is out here repping selinux_netl...t_setsockopt(9). slay, go read the kernel file, mwah 💋