get\_ordered\_context\_list(3) SELinux get\_ordered\_context\_list(3)

# [NAME](#NAME)

get\_ordered\_context\_list, get\_ordered\_context\_list\_with\_level, get\_default\_context, get\_default\_context\_with\_level, get\_default\_context\_with\_role, get\_default\_context\_with\_rolelevel, query\_user\_context, manual\_user\_enter\_context, get\_default\_role - determine SELinux context(s) for user sessions

# [SYNOPSIS](#SYNOPSIS)

**#include <selinux/selinux.h>**  
**#include <selinux/get\_context\_list.h>**

**int get\_ordered\_context\_list(const char \*user, const char \*fromcon, char \*\*\*list);**

**int get\_ordered\_context\_list\_with\_level(const char \*user, const char \*level, const char \*fromcon, char \*\*\*list);**

**int get\_default\_context(const char \*user, const char \*fromcon, char \*\*newcon);**

**int get\_default\_context\_with\_level(const char \*user, const char \*level, const char \*fromcon, char \*\*newcon);**

**int get\_default\_context\_with\_role(const char \*user, const char \*role, const char \*fromcon, char \*\*newcon);**

**int get\_default\_context\_with\_rolelevel(const char \*user, const char \*role, const char \*level, const char \*fromcon, char \*\*newcon);**

**int query\_user\_context(char \*\*list, char \*\*newcon);**

**int manual\_user\_enter\_context(const char \*user, char \*\*newcon);**

**int get\_default\_type(const char \*role, char \*\*type);**

# [DESCRIPTION](#DESCRIPTION)

This family of functions can be used to obtain either a prioritized list of all reachable security contexts for a given SELinux user or a single default (highest priority) context for a given SELinux user for use by login-like programs. These functions takes a SELinux user identity that must be defined in the SELinux policy as their input, not a Linux username. Most callers should typically first call [**getseuserbyname(3)**](/man/os/libselinux/getseuserbyname.3) to look up the SELinux user identity and level for a given Linux username and then invoke one of **get\_ordered\_context\_list\_with\_level**() or **get\_default\_context\_with\_level**() with the returned SELinux user and level as inputs.

**get\_ordered\_context\_list**() obtains the list of contexts for the specified SELinux *user* identity that are reachable from the specified *fromcon* context based on the global */etc/selinux/{SELINUXTYPE}/contexts/default\_contexts* file and the per-user */etc/selinux/{SELINUXTYPE}/contexts/users/<username>* file if it exists. The *fromcon* parameter may be NULL to indicate that the current context should be used. The function returns the number of contexts in the list, or -1 upon errors. The list must be freed using the [**freeconary**(3)](/man/os/libselinux/freeconary.3) function.

**get\_ordered\_context\_list\_with\_level**() invokes the **get\_ordered\_context\_list**() function and applies the specified level.

**get\_default\_context**() is the same as **get\_ordered\_context\_list**() but only returns a single context which has to be freed with [**freecon**(3)](/man/os/libselinux/freecon.3).

**get\_default\_context\_with\_level**() invokes the **get\_default\_context**() function and applies the specified level.

**get\_default\_context\_with\_role**() is the same as **get\_default\_context**() but only returns a context with the specified role, returning -1 if no such context is reachable for the user.

**get\_default\_context\_with\_rolelevel**() invokes the **get\_default\_context\_with\_role**() function and applies the specified level.

**query\_user\_context**() takes a list of contexts, queries the user via stdin/stdout as to which context they want, and returns a new context as selected by the user (which has to be freed with [**freecon**(3)](/man/os/libselinux/freecon.3)).

**manual\_user\_enter\_context**() allows the user to manually enter a context as a fallback if a list of authorized contexts could not be obtained. Caller must free via [**freecon**(3)](/man/os/libselinux/freecon.3).

**get\_default\_type**() Get the default type (domain) for *role* and set *type* to refer to it, which has to be freed with free.

# [RETURN VALUE](#RETURN_VALUE)

**get\_ordered\_context\_list**() and **get\_ordered\_context\_list\_with\_level**() return the number of contexts in the list upon success or -1 upon errors. The other functions return 0 for success or -1 for errors.

# [SEE ALSO](#SEE_ALSO)

[**selinux**(8)](/man/os/libselinux/selinux.8), [**freeconary**(3)](/man/os/libselinux/freeconary.3), [**freecon**(3)](/man/os/libselinux/freecon.3), [**security\_compute\_av**(3)](/man/os/libselinux/security_compute_av.3), [**getseuserbyname**(3)](/man/os/libselinux/getseuserbyname.3)

1 January 2004 russell@coker.com.au

---

Document: get_default_context_with_role(3) from libselinux 3.11-r2 (Chainguard OS)
Source: https://github.com/SELinuxProject/selinux.git