selabel_open, selabel_close — userspace SELinux labeling interface


#include <selinux/selinux.h>
#include <selinux/label.h>

struct selabel_handle *selabel_open(int backend, const struct selinux_opt *options,
unsigned nopt);

void selabel_close(struct selabel_handle *hnd);


selabel_open() is used to initialize a labeling handle to be used for lookup operations.  The backend argument specifies which backend is to be opened; the list of current backends appears in Backends below.

The options argument should be NULL or a pointer to an array of selinux_opt structures of length nopt:

struct selinux_opt {
	int	type;
	const char	*value;

The available option types are described in Global Options below as well as in the documentation for each individual backend.  The return value on success is a non-NULL value for use in subsequent label operations.

selabel_close() terminates use of a handle, freeing any internal resources associated with it.  After this call has been made, the handle must not be used again.

Global Options

Global options which may be passed to selabel_open() include the following:


The option with a type code of zero is a no-op.  Thus an array of options may be initizalized to zero and any untouched elements will not cause an error.


A non-null value for this option enables context validation.  By default, security_check_context(3) is used; a custom validation function can be provided via selinux_set_callback(3). Note that an invalid context may not be treated as an error unless it is actually encountered during a lookup operation.


A non-null value for this option enables the generation of an SHA1 digest of the spec files loaded as described in selabel_digest(3)



File contexts backend, described in selabel_file(5).


Media contexts backend, described in selabel_media(5).


X Windows contexts backend, described in selabel_x(5).


Database objects contexts backend, described in selabel_db(5).

Return Value

A non-NULL handle value is returned on success.  On error, NULL is returned and errno is set appropriately.


Eamon Walsh <>

See Also

selabel_lookup(3), selabel_stats(3), selinux_set_callback(3), selinux(8)

Referenced By

matchpathcon(3), selabel_db(5), selabel_digest(3), selabel_file(5), selabel_get_digests_all_partial_matches(3), selabel_lookup(3), selabel_lookup_best_match(3), selabel_media(5), selabel_partial_match(3), selabel_stats(3), selabel_x(5), selinux_restorecon(3), selinux_restorecon_default_handle(3), selinux_restorecon_set_sehandle(3), selinux_restorecon_xattr(3), selinux_set_callback(3).

The man page selabel_close(3) is an alias of selabel_open(3).

18 Jun 2007 SELinux API documentation