Module lsm 

Structs

SetEnforceGuard 🔒

A type which will reset SELinux back to enforcing mode when dropped. This is a workaround for the deep difficulties in trying to reliably gain the mac_admin permission (install_t).

UnlabeledType 🔒

The type of the kernel’s unlabeled initial context. Files with it (e.g. created while SELinux was disabled) need relabeling just like files without any label.

Enums

SELinuxLabelState 🔒

The labeling state; “unsupported” is distinct as we need to handle cases like the ESP which don’t support labeling.

Constants

SELF_CURRENT 🔒

SELINUXFS 🔒

The mount path for selinux

SELINUX_INITIAL_SID_UNLABELED 🔒

The kernel initial SID used for objects without a label.

SELINUX_XATTR 🔒

The SELinux xattr

Functions

atomic_replace_labeled 🔒

A wrapper for atomically writing a file, also optionally setting a SELinux label. The label is looked up for destname as if root were /, so pass the directory that stands for the target’s root, never a subdirectory of it.

context_type 🔒

ensure_dir_labeled 🔒

A wrapper for creating a directory, also optionally setting a SELinux label.

ensure_dir_labeled_recurse 🔒

Recursively ensure all files under a directory have SELinux labels. Uses the walk API with noxdev and skip_mountpoints to avoid crossing mount point boundaries (e.g. into sysfs, procfs, etc.). The provided skip parameter is a device/inode pair that we will ignore (and not traverse into).

ensure_labeled_inner 🔒

get_current_security_context 🔒

Get the current process SELinux security context

has_security_selinux 🔒

Query the SELinux labeling for a particular path

has_security_selinux_inner 🔒

have_selinux_policy 🔒

Query whether SELinux is apparently enabled in the target root

host_selinux_enabled 🔒

Whether SELinux is enabled on the host, as observed from PID 1’s mount namespace.

new_sepolicy_at 🔒

A thin wrapper for loading a SELinux policy that maps “policy nonexistent” to None.

optional_label 🔒

Look up the label for a path in a policy, returning None if no match is found.

relabel 🔒

Given the policy, relabel the target file or directory. Optionally, an override for the path can be provided to set the label as if the target has that filename.

relabel_recurse 🔒

Recursively relabel the target directory.

relabel_recurse_inner 🔒

require_label 🔒

Look up the label for a path in a policy, and error if one is not found.

selinux_enabled 🔒

Whether SELinux is enabled for the current process.

selinux_ensure_install 🔒

Ensure that the current process has the capability to write SELinux security contexts unknown to the current policy.

selinux_ensure_install_or_setenforce 🔒

Try to enter the install_t domain, but if we can’t do that, then just setenforce 0.

selinux_set_permissive 🔒

set_security_selinux 🔒

A thin wrapper for invoking fsetxattr(security.selinux)

set_security_selinux_path 🔒

Directly set the security.selinux extended attribute on the target path. Symbolic links are not followed for the target.

test_install_t 🔒

Check if the current process has the capability to write SELinux security contexts unknown to the current policy. In SELinux terms this capability is gated under mac_admin (admin control over SELinux state), and in the Fedora policy at least it’s part of install_t.

xattrs_have_selinux 🔒

Check if the ostree-formatted extended attributes include a security.selinux value.