1selinux_restorecon(3) SELinux API documentation selinux_restorecon(3)
2
6 selinux_restorecon - restore file(s) default SELinux security contexts
7
9 #include <selinux/restorecon.h>
10 int selinux_restorecon(const char *pathname,
12 unsigned int restorecon_flags);
13 int selinux_restorecon_parallel(const char *pathname,
15 unsigned int restorecon_flags,
16 size_t nthreads);
17
19 selinux_restorecon() restores file default security contexts on
20 filesystems that support extended attributes (see xattr(7)), based on:
21 pathname containing a directory or file to be relabeled.
23 If this is a directory and the restorecon_flags SELINUX_RESTORE‐
24 CON_RECURSE has been set (for descending through directories),
25 then selinux_restorecon() will write an SHA256 digest of spec‐
26 file entries calculated by selabel_get_digests_all_par‐
27 tial_matches(3) to an extended attribute of security.sehash once
28 the relabeling has been completed successfully (see the NOTES
29 section for details).
30 These digests will be checked should selinux_restorecon() be re‐
31 run with the restorecon_flags SELINUX_RESTORECON_RECURSE flag
32 set. If any of the specfile entries had been updated, the digest
33 will also be updated. However if the digest is the same, no re‐
34 labeling checks will take place.
35 The restorecon_flags that can be used to manage the usage of the
36 SHA256 digest are:
37 SELINUX_RESTORECON_SKIP_DIGEST
38 SELINUX_RESTORECON_IGNORE_DIGEST
39 restorecon_flags contains the labeling option/rules as follows:
41 SELINUX_RESTORECON_SKIP_DIGEST Do not check or update any
44 extended attribute security.sehash entries.
45 SELINUX_RESTORECON_IGNORE_DIGEST force the checking of
47 labels even if the stored SHA256 digest matches the spec‐
48 file entries SHA256 digest. The specfile entries digest
49 will be written to the security.sehash extended attribute
50 once relabeling has been completed successfully provided
51 the SELINUX_RESTORECON_NOCHANGE flag has not been set.
52 SELINUX_RESTORECON_NOCHANGE don't change any file labels
54 (passive check) or update the digest in the security.se‐
55 hash extended attribute.
56 SELINUX_RESTORECON_SET_SPECFILE_CTX If set, reset the
58 files label to match the default specfile context. If
59 not set only reset the files "type" component of the con‐
60 text to match the default specfile context.
61 SELINUX_RESTORECON_RECURSE change file and directory la‐
63 bels recursively (descend directories) and if successful
64 write an SHA256 digest of the specfile entries to an ex‐
65 tended attribute as described in the NOTES section.
66 SELINUX_RESTORECON_VERBOSE log file label changes.
68 Note that if SELINUX_RESTORECON_VERBOSE and
69 SELINUX_RESTORECON_PROGRESS flags are set, then
70 SELINUX_RESTORECON_PROGRESS will take precedence.
71 SELINUX_RESTORECON_PROGRESS show progress by outputting
73 the number of files in 1k blocks processed to stdout. If
74 the SELINUX_RESTORECON_MASS_RELABEL flag is also set then
75 the approximate percentage complete will be shown.
76 SELINUX_RESTORECON_MASS_RELABEL generally set when rela‐
78 beling the entire OS, that will then show the approximate
79 percentage complete. The SELINUX_RESTORECON_PROGRESS flag
80 must also be set.
81 SELINUX_RESTORECON_REALPATH convert passed-in pathname to
83 the canonical pathname using realpath(3).
84 SELINUX_RESTORECON_XDEV prevent descending into directo‐
86 ries that have a different device number than the path‐
87 name entry from which the descent began.
88 SELINUX_RESTORECON_ADD_ASSOC attempt to add an associa‐
90 tion between an inode and a specification. If there is
91 already an association for the inode and it conflicts
92 with the specification, then use the last matching speci‐
93 fication.
94 SELINUX_RESTORECON_ABORT_ON_ERROR abort on errors during
96 the file tree walk.
97 SELINUX_RESTORECON_SYSLOG_CHANGES log any label changes
99 to syslog(3).
100 SELINUX_RESTORECON_LOG_MATCHES log what specfile context
102 matched each file.
103 SELINUX_RESTORECON_IGNORE_NOENTRY ignore files that do
105 not exist.
106 SELINUX_RESTORECON_IGNORE_MOUNTS do not read /proc/mounts
108 to obtain a list of non-seclabel mounts to be excluded
109 from relabeling checks.
110 Setting SELINUX_RESTORECON_IGNORE_MOUNTS is useful where
111 there is a non-seclabel fs mounted with a seclabel fs
112 mounted on a directory below this.
113 SELINUX_RESTORECON_CONFLICT_ERROR to treat conflicting
115 specifications, such as where two hardlinks for the same
116 inode have different contexts, as errors.
117 The behavior regarding the checking and updating of the SHA256
119 digest described above is the default behavior. It is possible
120 to change this by first calling selabel_open(3) and not enabling
121 the SELABEL_OPT_DIGEST option, then calling selinux_restore‐
122 con_set_sehandle(3) to set the handle to be used by selinux_re‐
123 storecon(3).
124 If the pathname is a directory path, then it is possible to set
126 directories to be excluded from the path by calling selinux_re‐
127 storecon_set_exclude_list(3) with a NULL terminated list before
128 calling selinux_restorecon(3).
129 By default selinux_restorecon(3) reads /proc/mounts to obtain a
131 list of non-seclabel mounts to be excluded from relabeling
132 checks unless the SELINUX_RESTORECON_IGNORE_MOUNTS flag has been
133 set.
134 selinux_restorecon_parallel() is similar to selinux_restorecon(3), but
136 accepts another parameter that allows to run relabeling over multiple
137 threads:
138 nthreads specifies the number of threads to use during relabel‐
140 ing. When set to 1, the behavior is the same as calling
141 selinux_restorecon(3). When set to 0, the function will try to
142 use as many threads as there are online CPU cores. When set to
143 any other number, the function will try to use the given number
144 of threads.
145 Note that to use the parallel relabeling capability, the calling
147 process must be linked with the libpthread library (either at
148 compile time or dynamically at run time). Otherwise the function
149 will print a warning and fall back to the single threaded mode.
150
152 On success, zero is returned. On error, -1 is returned and errno is
153 set appropriately.
154
156 1. To improve performance when relabeling file systems recursively
157 (e.g. the restorecon_flags SELINUX_RESTORECON_RECURSE flag is set)
158 selinux_restorecon() will write a calculated SHA256 digest of the
159 specfile entries returned by selabel_get_digests_all_par‐
160 tial_matches(3) to an extended attribute named security.sehash for
161 each directory in the pathname path.
162 2. To check the extended attribute entry use getfattr(1), for example:
164 getfattr -e hex -n security.sehash /
166 3. Should any of the specfile entries have changed, then when
168 selinux_restorecon() is run again with the SELINUX_RESTORECON_RE‐
169 CURSE flag set, new SHA256 digests will be calculated and all files
170 automatically relabeled depending on the settings of the
171 SELINUX_RESTORECON_SET_SPECFILE_CTX flag (provided SELINUX_RESTORE‐
172 CON_NOCHANGE is not set).
173 4. /sys and in-memory filesystems do not support the security.sehash
175 extended attribute and are automatically excluded from any relabel‐
176 ing checks.
177 5. By default stderr is used to log output messages and errors. This
179 may be changed by calling selinux_set_callback(3) with the
180 SELINUX_CB_LOG type option.
181
183 selabel_get_digests_all_partial_matches(3),
184 selinux_restorecon_set_sehandle(3),
185 selinux_restorecon_default_handle(3),
186 selinux_restorecon_set_exclude_list(3),
187 selinux_restorecon_set_alt_rootpath(3),
188 selinux_restorecon_xattr(3),
189 selinux_set_callback(3)
190Security Enhanced Linux 20 Oct 2015 selinux_restorecon(3)