selinux_secmark_enabled(9)

📦 version 7.3.1, in nixpkgs unstable

💖 selinux_secmark_enabled — the "is SECMARK on rn??" check 💖

okay so this one is a kernel API manual page, bestie — it's selinux_secmark_enabled(9), and it lives in the SELinux corner of the kernel. it's short, it's sweet, and it's literally just a vibe check for SECMARK. let's go ✨

🌸 NAME 🌸

selinux_secmark_enabled — check to see if SECMARK is currently enabled 🎀

like. that's the whole job. she peeks, she reports, she leaves. iconic behaviour tbh 💅

✨ SYNOPSIS ✨

int selinux_secmark_enabled (void );

that's it. no params, no drama, no argc/argv situations. she takes nothing and she gives you an int 🫶

🦋 ARGUMENTS 🦋

  • void — no arguments. literally none. zero. not a single one. she needs nothing from you, she's independent like that 👑

🔥 DESCRIPTION 🔥

okay so here's the tea ☕ — this function goes and checks the SECMARK reference counter to see if any SECMARK targets are currently configured.

the logic is honestly so simple it's giving main character energy:

  • if the reference counter is greater than zero, SECMARK is considered to be enabled 💚
  • it returns true (1) if SECMARK is enabled
  • it returns false (0) if SECMARK is disabled 💀

and then there's the plot twist 🙈 — if the always_check_network policy capability is enabled, then SECMARK is always considered enabled. like, no matter what the counter says. periodt. she said "always" and she meant it ✨

ngl the always_check_network thing is the one sneaky bit — if that policy capability is on, you're getting 1 back and that's just how it is, bestie 🤷‍♀️

🌈 SEE ALSO 🌈

go read the source, it's right here in the kernel, no cap:

  • Kernel file ./security/selinux/hooks.c

and the whole friend group of related functions — collect them all like stickers 🎀:

okay that's the whole page, and honestly? she ate 💅 this one came from ./security/selinux, dated October 2026 — so like, mark your calendars bestie, and go check that counter 🦋✨💖

📦 where this page comes from