selinux\_restorecon\_xattr(3) SELinux API documentation selinux\_restorecon\_xattr(3)

# [NAME](#NAME)

selinux\_restorecon\_xattr - manage default *security.sehash* extended attribute entries added by [**selinux\_restorecon**(3)](/man/os/libselinux/selinux_restorecon.3), [**setfiles**(8)](/man/os/libselinux/setfiles.8) or [**restorecon**(8)](/man/os/libselinux/restorecon.8).

# [SYNOPSIS](#SYNOPSIS)

**#include <selinux/restorecon.h>**

**int selinux\_restorecon\_xattr(const char \*pathname,**

**unsigned int xattr\_flags,**  
**struct dir\_xattr \*\*\*xattr\_list);**

# [DESCRIPTION](#DESCRIPTION)

**selinux\_restorecon\_xattr**() returns a linked list of **dir\_xattr** structures containing information described below based on:

*pathname* containing a directory tree to be searched for *security.sehash* extended attribute entries.

*xattr\_flags* contains options as follows:

**SELINUX\_RESTORECON\_XATTR\_RECURSE** recursively descend directories.

**SELINUX\_RESTORECON\_XATTR\_DELETE\_NONMATCH\_DIGESTS** delete non-matching digests from each directory in *pathname*.

**SELINUX\_RESTORECON\_XATTR\_DELETE\_ALL\_DIGESTS** delete all digests from each directory in *pathname*.

**SELINUX\_RESTORECON\_XATTR\_IGNORE\_MOUNTS** do not read **/proc/mounts** to obtain a list of non-seclabel mounts to be excluded from the search.  
Setting **SELINUX\_RESTORECON\_XATTR\_IGNORE\_MOUNTS** is useful where there is a non-seclabel fs mounted with a seclabel fs mounted on a directory below this.

*xattr\_list* is the returned pointer to a linked list of **dir\_xattr** structures, each containing the following information:

```
struct dir_xattr {
	char *directory;
	char *digest;    /* Printable hex encoded string */
	enum digest_result result;
	struct dir_xattr *next;
};
```

The **result** entry is enumerated as follows:

```
enum digest_result {
	MATCH = 0,
	NOMATCH,
	DELETED_MATCH,
	DELETED_NOMATCH,
	ERROR
};
```

*xattr\_list* must be set to **NULL** before calling [**selinux\_restorecon\_xattr**(3)](/man/os/libselinux/selinux_restorecon_xattr.3). The caller is responsible for freeing the returned *xattr\_list* entries in the linked list.

See the **NOTES** section for more information.

# [RETURN VALUE](#RETURN_VALUE)

On success, zero is returned. On error, -1 is returned and *errno* is set appropriately.

# [NOTES](#NOTES)

1\.

By default [**selinux\_restorecon\_xattr**(3)](/man/os/libselinux/selinux_restorecon_xattr.3) will use the default set of specfiles described in [**files\_contexts**(5)](/man/os/libselinux/files_contexts.5) to calculate the SHA1 digests to be used for comparison. To change this default behavior [**selabel\_open**(3)](/man/os/libselinux/selabel_open.3) must be called specifying the required **SELABEL\_OPT\_PATH** and setting the **SELABEL\_OPT\_DIGEST** option to a non-NULL value. [**selinux\_restorecon\_set\_sehandle**(3)](/man/os/libselinux/selinux_restorecon_set_sehandle.3) is then called to set the handle to be used by [**selinux\_restorecon\_xattr**(3)](/man/os/libselinux/selinux_restorecon_xattr.3).

2\.

By default [**selinux\_restorecon\_xattr**(3)](/man/os/libselinux/selinux_restorecon_xattr.3) reads **/proc/mounts** to obtain a list of non-seclabel mounts to be excluded from searches unless the **SELINUX\_RESTORECON\_XATTR\_IGNORE\_MOUNTS** flag has been set.

3\.

**RAMFS** and **TMPFS** filesystems do not support the *security.sehash* extended attribute and are automatically excluded from searches.

4\.

By default **stderr** is used to log output messages and errors. This may be changed by calling [**selinux\_set\_callback**(3)](/man/os/libselinux/selinux_set_callback.3) with the **SELINUX\_CB\_LOG** *type* option.

# [SEE ALSO](#SEE_ALSO)

[**selinux\_restorecon**(3)](/man/os/libselinux/selinux_restorecon.3)  
[**selinux\_restorecon\_set\_sehandle**(3)](/man/os/libselinux/selinux_restorecon_set_sehandle.3),  
[**selinux\_restorecon\_default\_handle**(3)](/man/os/libselinux/selinux_restorecon_default_handle.3),  
[**selinux\_restorecon\_set\_exclude\_list**(3)](/man/os/libselinux/selinux_restorecon_set_exclude_list.3),  
[**selinux\_restorecon\_set\_alt\_rootpath**(3)](/man/os/libselinux/selinux_restorecon_set_alt_rootpath.3),  
[**selinux\_set\_callback**(3)](/man/os/libselinux/selinux_set_callback.3)

30 July 2016

---

Document: selinux_restorecon_xattr(3) from libselinux 3.11-r2 (Chainguard OS)
Source: https://github.com/SELinuxProject/selinux.git