selabel_x(5) — Linux manual page


selabel_x(5)            SELinux API documentation           selabel_x(5)

NAME         top

       selabel_x - userspace SELinux labeling interface and
       configuration file format for the X Window System contexts
       backend. This backend is also used to determine the default
       context for labeling remotely connected X clients

SYNOPSIS         top

       #include <selinux/label.h>

       int selabel_lookup(struct selabel_handle *hnd,
                          char **context,
                          const char *object_name, int object_type);

       int selabel_lookup_raw(struct selabel_handle *hnd,
                          char **context,
                          const char *object_name, int object_type);

DESCRIPTION         top

       The X contexts backend maps from X Window System object names
       into security contexts. It is used to find the appropriate
       context for X Window System objects whose significance and/or
       usage semantics are determined primarily by name. The returned
       context must be freed using freecon(3).
       selabel_lookup(3) describes the function with its return and
       error codes.

       This backend is also used to determine the default context for
       labeling remotely connected X clients.

       The object_type argument should be set to one of the following

                     The object_name argument specifies the name of a
                     window property, such as "WM_NAME".

                     The object_name argument specifies the name of a
                     selection, such as "PRIMARY".

                     The object_name argument specifies the name of a
                     protocol extension, such as "RENDER".

                     The object_name argument specifies the name of an
                     event type, such as "X11:ButtonPress".

                     The object_name argument is ignored, however it
                     should be set to either * (an asterisk or
                     'wildcard' that will select the default entry) or a
                     specific entry such as "remote" in the X contexts
                     file as shown in the EXAMPLE section. The default
                     context for labeling remote X clients is then

                     Like SELABEL_X_PROP, but checks if the property was
                     marked as being polyinstantiated. See NOTES below.

                     Like SELABEL_X_SELN, but checks if the selection
                     was marked as being polyinstantiated. See NOTES

       Any messages generated by selabel_lookup(3) are sent to stderr by
       default, although this can be changed by selinux_set_callback(3).

       selabel_lookup_raw behaves identically to selabel_lookup but does
       not perform context translation.

       The FILES section details the configuration files used to
       determine the X object context.

OPTIONS         top

       In addition to the global options described in selabel_open(3),
       this backend recognizes the following options:

                     A non-null value for this option specifies a path
                     to a file that will be opened in lieu of the
                     standard X contexts file (see the FILES section for

FILES         top

       The X context file used to retrieve a default context depends on
       the SELABEL_OPT_PATH parameter passed to selabel_open(3). If
       NULL, then the SELABEL_OPT_PATH value will default to the active
       policy X contexts location (as returned by
       selinux_x_context_path(3)), otherwise the actual SELABEL_OPT_PATH
       value specified is used.

       The default X object contexts file is:

       Where {SELINUXTYPE} is the entry from the selinux configuration
       file config (see selinux_config(5)).

       The entries within the X contexts file are shown in the Object
       Name String Values and FILE FORMAT sections.

Object Name String Values         top

       The string name assigned to each object_type argument that can be
       present in the X contexts file are:
                   │ object_typeText Name      │
                   │ SELABEL_X_PROP     │ property       │
                   │ SELABEL_X_SELN     │ selection      │
                   │ SELABEL_X_EXT      │ extension      │
                   │ SELABEL_X_EVENT    │ event          │
                   │ SELABEL_X_CLIENT   │ client         │
                   │ SELABEL_X_POLYPROP │ poly_property  │
                   │ SELABEL_X_POLYSELN │ poly_selection │

FILE FORMAT         top

       Each line within the X contexts file is as follows:
              object_type object_name context

                     This is the string representation of the object
                     type shown in the Object Name String Values
                     section.  There can be multiple lines with the same
                     object_type string that will form a block of
                     entries (each with a different object_name entry).
                     These are the object names of the specific X-server
                     resource such as PRIMARY, CUT_BUFFER0 etc. They are
                     generally defined in the X-server source code
                     (protocol.txt and BuiltInAtoms in the dix directory
                     of the xorg-server source package).  The entry can
                     contain '*' for wildcard matching or '?' for
                     substitution.  Note that if the '*' is used, then
                     be aware that the order of entries in the file is
                     important. The '*' on its own is used to ensure a
                     default fallback context is assigned and should be
                     the last entry in the object_type block.
                     The security context that will be applied to the

       Example 1:

       # object_type  object_name  context
       selection      PRIMARY      system_u:object_r:clipboard_xselection_t:s0
       selection      *            system_u:object_r:xselection_t:s0

       Example 2 - This example shows how a client entry can be
       configured to ensure an entry is always found:

       # object_type  object_name  context
       client         *            system_u:object_r:remote_t:s0

NOTES         top

       1.  Properties and selections are marked as either
           polyinstantiated or not. For these name types, the "POLY"
           option searches only the names marked as being
           polyinstantiated, while the other option searches only the
           names marked as not being polyinstantiated. Users of the
           interface should check both mappings, optionally taking
           action based on the result (e.g. polyinstantiating the

       2.  If contexts are to be validated, then the global option
           SELABEL_OPT_VALIDATE must be set before calling
           selabel_open(3). If this is not set, then it is possible for
           an invalid context to be returned.

SEE ALSO         top

       selinux(8), selabel_open(3), selabel_lookup(3), selabel_stats(3),
       selabel_close(3), selinux_set_callback(3),
       selinux_x_context_path(3), freecon(3), selinux_config(5)

COLOPHON         top

       This page is part of the selinux (Security-Enhanced Linux user-
       space libraries and tools) project.  Information about the
       project can be found at 
       ⟨⟩.  If you have a
       bug report for this manual page, see
       This page was obtained from the project's upstream Git repository
       ⟨⟩ on 2024-06-14.  (At
       that time, the date of the most recent commit that was found in
       the repository was 2023-05-11.)  If you discover any rendering
       problems in this HTML version of the page, or you believe there
       is a better or more up-to-date source for the page, or you have
       corrections or improvements to the information in this COLOPHON
       (which is not part of the original manual page), send a mail to

Security Enhanced Linux        29 Nov 2011                  selabel_x(5)

Pages that refer to this page: selabel_open(3)