selabel\_open(3) SELinux API documentation selabel\_open(3)

# [NAME](#NAME)

selabel\_open, selabel\_close - userspace SELinux labeling interface

# [SYNOPSIS](#SYNOPSIS)

**#include <selinux/selinux.h>**  
**#include <selinux/label.h>**

**struct selabel\_handle \*selabel\_open(unsigned int backend,**  
**const struct selinux\_opt \*options,**  
**unsigned nopt);**

**void selabel\_close(struct selabel\_handle \*hnd);**

# [DESCRIPTION](#DESCRIPTION)

**selabel\_open**() is used to initialize a labeling handle to be used for lookup operations. The *backend* argument specifies which backend is to be opened; the list of current backends appears in **BACKENDS** below.

The *options* argument should be NULL or a pointer to an array of **selinux\_opt** structures of length *nopt*:

```
struct selinux_opt {
	int	type;
	const char	*value;
};
```

The available option types are described in **GLOBAL OPTIONS** below as well as in the documentation for each individual backend. The return value on success is a non-NULL value for use in subsequent label operations.

**selabel\_close**() terminates use of a handle, freeing any internal resources associated with it. After this call has been made, the handle must not be used again.

# [GLOBAL OPTIONS](#GLOBAL_OPTIONS)

Global options which may be passed to **selabel\_open**() include the following:

[**SELABEL\_OPT\_UNUSED**](#SELABEL_OPT_UNUSED)

The option with a type code of zero is a no-op. Thus an array of options may be initizalized to zero and any untouched elements will not cause an error.

[**SELABEL\_OPT\_VALIDATE**](#SELABEL_OPT_VALIDATE)

A non-null value for this option enables context validation. By default, [**security\_check\_context**(3)](/man/os/libselinux/security_check_context.3) is used; a custom validation function can be provided via [**selinux\_set\_callback**(3)](/man/os/libselinux/selinux_set_callback.3). Note that an invalid context may not be treated as an error unless it is actually encountered during a lookup operation.

[**SELABEL\_OPT\_DIGEST**](#SELABEL_OPT_DIGEST)

A non-null value for this option enables the generation of an SHA1 digest of the spec files loaded as described in [**selabel\_digest**(3)](/man/os/libselinux/selabel_digest.3)

# [BACKENDS](#BACKENDS)

[**SELABEL\_CTX\_FILE**](#SELABEL_CTX_FILE)

File contexts backend, described in [**selabel\_file**(5)](/man/os/libselinux/selabel_file.5).

[**SELABEL\_CTX\_MEDIA**](#SELABEL_CTX_MEDIA)

Media contexts backend, described in [**selabel\_media**(5)](/man/os/libselinux/selabel_media.5).

[**SELABEL\_CTX\_X**](#SELABEL_CTX_X)

X Windows contexts backend, described in [**selabel\_x**(5)](/man/os/libselinux/selabel_x.5).

[**SELABEL\_CTX\_DB**](#SELABEL_CTX_DB)

Database objects contexts backend, described in [**selabel\_db**(5)](/man/os/libselinux/selabel_db.5).

# [RETURN VALUE](#RETURN_VALUE)

A non-NULL handle value is returned on success. On error, NULL is returned and *errno* is set appropriately.

# [AUTHOR](#AUTHOR)

Eamon Walsh <ewalsh@tycho.nsa.gov>

# [SEE ALSO](#SEE_ALSO)

[**selabel\_lookup**(3)](/man/os/libselinux/selabel_lookup.3), [**selabel\_stats**(3)](/man/os/libselinux/selabel_stats.3), [**selinux\_set\_callback**(3)](/man/os/libselinux/selinux_set_callback.3), [**selinux**(8)](/man/os/libselinux/selinux.8)

18 Jun 2007

---

Document: selabel_close(3) from libselinux 3.11-r2 (Chainguard OS)
Source: https://github.com/SELinuxProject/selinux.git