matchpathcon(3) SELinux API documentation matchpathcon(3)

# [NAME](#NAME)

matchpathcon, matchpathcon\_index - get the default SELinux security context for the specified path from the file contexts configuration

# [SYNOPSIS](#SYNOPSIS)

**#include <selinux/selinux.h>**

**int matchpathcon\_init(const char \*path);**

**int matchpathcon\_init\_prefix(const char \*path, const char \*prefix);**

**int matchpathcon\_fini(void);**

**int matchpathcon(const char \*path, mode\_t mode, char \*\*con);**

**int matchpathcon\_index(const char \*name, mode\_t mode, char \*\*con);**

# [DESCRIPTION](#DESCRIPTION)

This family of functions is deprecated. For new code, please use [**selabel\_open**(3)](/man/os/libselinux/selabel_open.3) with the **SELABEL\_CTX\_FILE** backend in place of **matchpathcon\_init**(), use [**selabel\_close**(3)](/man/os/libselinux/selabel_close.3) in place of **matchpathcon\_fini**(), and use [**selabel\_lookup**(3)](/man/os/libselinux/selabel_lookup.3) in place of **matchpathcon**().

The remaining description below is for the legacy interface.

**matchpathcon\_init**() loads the file contexts configuration specified by *path* into memory for use by subsequent **matchpathcon**() calls. If *path* is NULL, then the active file contexts configuration is loaded by default, i.e. the path returned by [**selinux\_file\_context\_path**(3)](/man/os/libselinux/selinux_file_context_path.3). Unless the **MATCHPATHCON\_BASEONLY** flag has been set via [**set\_matchpathcon\_flags**(3)](/man/os/libselinux/set_matchpathcon_flags.3), files with the same path prefix but a **.homedirs** and **.local** suffix are also looked up and loaded if present. These files provide dynamically generated entries for user home directories and for local customizations.

**matchpathcon\_init\_prefix**() is the same as **matchpathcon\_init**() but only loads entries with regular expressions whose first pathname component is a prefix of *prefix* , e.g. pass "/dev" if you only intend to call **matchpathcon**() with pathnames beginning with /dev. However, this optimization is no longer necessary due to the use of *file\_contexts.bin* files with precompiled regular expressions, so use of this interface is deprecated.

**matchpathcon\_fini**() frees the memory allocated by a prior call to **matchpathcon\_init.**() This function can be used to free and reset the internal state between multiple **matchpathcon\_init**() calls, or to free memory when finished using **matchpathcon**().

**matchpathcon**() matches the specified *pathname,* after transformation via [**realpath**(3)](/man/os/libselinux/realpath.3) excepting any final symbolic link component if S\_IFLNK was specified as the *mode,* and *mode* against the *file contexts* configuration and sets the security context *con* to refer to the resulting context. The caller must free the returned security context *con* using [**freecon**(3)](/man/os/libselinux/freecon.3) when finished using it. *mode* can be 0 to disable mode matching, but should be provided whenever possible, as it may affect the matching. Only the file format bits (i.e. the file type) of the *mode* are used. If **matchpathcon\_init**() has not already been called, then this function will call it upon its first invocation with a NULL *path,* defaulting to the active file contexts configuration.

**matchpathcon\_index**() is the same as **matchpathcon**() but returns a specification index that can later be used in a [**matchpathcon\_filespec\_add**(3)](/man/os/libselinux/matchpathcon_filespec_add.3) call.

# [RETURN VALUE](#RETURN_VALUE)

Returns zero on success or -1 otherwise.

# [SEE ALSO](#SEE_ALSO)

[**selinux**(8)](/man/os/libselinux/selinux.8), [**set\_matchpathcon\_flags**(3)](/man/os/libselinux/set_matchpathcon_flags.3), [**set\_matchpathcon\_invalidcon**(3)](/man/os/libselinux/set_matchpathcon_invalidcon.3), [**set\_matchpathcon\_printf**(3)](/man/os/libselinux/set_matchpathcon_printf.3), [**matchpathcon\_filespec\_add**(3)](/man/os/libselinux/matchpathcon_filespec_add.3), [**matchpathcon\_checkmatches**(3)](/man/os/libselinux/matchpathcon_checkmatches.3), [**freecon**(3)](/man/os/libselinux/freecon.3), [**setfilecon**(3)](/man/os/libselinux/setfilecon.3), [**setfscreatecon**(3)](/man/os/libselinux/setfscreatecon.3)

21 November 2009 stephen.smalley.work@gmail.com

---

Document: matchpathcon_init(3) from libselinux 3.11-r2 (Chainguard OS)
Source: https://github.com/SELinuxProject/selinux.git