1getcon(3)                  SELinux API documentation                 getcon(3)
2
3
4

NAME

6       getcon,  getprevcon,  getpidcon  -  get  SELinux  security context of a
7       process
8
9       freecon, freeconary - free memory associated with SELinux security con‐
10       texts
11
12       getpeercon - get security context of a peer socket
13
14       setcon - set current security context of a process
15
16

SYNOPSIS

18       #include <selinux/selinux.h>
19
20       int getcon(char **context);
21
22       int getcon_raw(char **context);
23
24       int getprevcon(char **context);
25
26       int getprevcon_raw(char **context);
27
28       int getpidcon(pid_t pid, char **context);
29
30       int getpidcon_raw(pid_t pid, char **context);
31
32       int getpeercon(int fd, char **context);
33
34       int getpeercon_raw(int fd, char **context);
35
36       void freecon(char *con);
37
38       void freeconary(char **con);
39
40       int setcon(const char *context);
41
42       int setcon_raw(const char *context);
43
44

DESCRIPTION

46       getcon()
47              retrieves  the  context  of  the  current process, which must be
48              free'd with freecon().
49
50
51       getprevcon()
52              same as getcon but gets the context before the last exec.
53
54
55       getpidcon()
56              returns the process context for the specified PID, which must be
57              free'd with freecon().
58
59
60       getpeercon()
61              retrieves  the  context of the peer socket, which must be free'd
62              with freecon().
63
64
65       freecon()
66              frees the memory allocated for a security context.
67
68              If con is NULL, no operation is performed.
69
70
71       freeconary()
72              frees the memory allocated for a context array.
73
74              If con is NULL, no operation is performed.
75
76
77       setcon()
78              sets the current security context of the process to a new value.
79              Note that use of this function requires that the entire applica‐
80              tion be trusted to maintain any desired separation  between  the
81              old  and  new  security  contexts, unlike exec-based transitions
82              performed via setexeccon(3).  When possible, decompose your  ap‐
83              plication and use setexeccon(3) and execve(3) instead.
84
85              Since  access  to  file  descriptors  is revalidated upon use by
86              SELinux, the new context must be explicitly  authorized  in  the
87              policy  to use the descriptors opened by the old context if that
88              is desired.  Otherwise, attempts by the process to use  any  ex‐
89              isting  descriptors  (including stdin, stdout, and stderr) after
90              performing the setcon() will fail.
91
92              A multi-threaded application can perform  a  setcon()  prior  to
93              creating  any  child  threads,  in  which  case all of the child
94              threads will inherit the new context.  However, prior  to  Linux
95              2.6.28,  setcon() would fail if there are any other threads run‐
96              ning in the same process since this would yield an inconsistency
97              among  the  security contexts of threads sharing the same memory
98              space.  Since Linux 2.6.28, setcon() is  permitted  for  threads
99              within  a  multi-threaded process if the new security context is
100              bounded by the old security context, where the bounded  relation
101              is defined through typebounds statements in the policy and guar‐
102              antees that the new security context has a subset of the permis‐
103              sions of the old security context.
104
105              If the process was being ptraced at the time of the setcon() op‐
106              eration, ptrace permission will be revalidated against  the  new
107              context  and the setcon() will fail if it is not allowed by pol‐
108              icy.
109
110
111       *_raw()
112              getcon_raw(),   getprevcon_raw(),   getpidcon_raw(),    getpeer‐
113              con_raw()  and  setcon_raw() behave identically to their non-raw
114              counterparts but do not perform context translation.
115
116

RETURN VALUE

118       On error -1 is returned with errno set.  On success 0 is returned.
119
120

NOTES

122       The retrieval functions might return success and set *context  to  NULL
123       if and only if SELinux is not enabled.
124
125

SEE ALSO

127       selinux(8), setexeccon(3)
128
129
130
131russell@coker.com.au           21 December 2011                      getcon(3)
Impressum