NAME

       selinux_restorecon_xattr   -   manage   default  security.sehash  extended  attribute  entries  added  by
       selinux_restorecon(3), setfiles(8) or restorecon(8).

SYNOPSIS

       #include <selinux/restorecon.h>

       int selinux_restorecon_xattr(const char *pathname,
                              unsigned int xattr_flags,
                              struct dir_xattr ***xattr_list);

DESCRIPTION

       selinux_restorecon_xattr() returns a linked list of dir_xattr structures containing information described
       below based on:

              pathname  containing  a  directory  tree  to  be  searched  for security.sehash extended attribute
              entries.

              xattr_flags contains options as follows:

                     SELINUX_RESTORECON_XATTR_RECURSE recursively descend directories.

                     SELINUX_RESTORECON_XATTR_DELETE_NONMATCH_DIGESTS  delete  non-matching  digests  from  each
                     directory in pathname.

                     SELINUX_RESTORECON_XATTR_DELETE_ALL_DIGESTS  delete  all  digests  from  each  directory in
                     pathname.

                     SELINUX_RESTORECON_XATTR_IGNORE_MOUNTS do not read /proc/mounts to obtain a  list  of  non-
                     seclabel mounts to be excluded from the search.
                     Setting  SELINUX_RESTORECON_XATTR_IGNORE_MOUNTS  is useful where there is a non-seclabel fs
                     mounted with a seclabel fs mounted on a directory below this.

              xattr_list is the returned pointer to a linked list of dir_xattr structures, each  containing  the
              following information:

                     struct dir_xattr {
                         char *directory;
                         char *digest;    /* Printable hex encoded string */
                         enum digest_result result;
                         struct dir_xattr *next;
                     };

              The result entry is enumerated as follows:
                     enum digest_result {
                         MATCH = 0,
                         NOMATCH,
                         DELETED_MATCH,
                         DELETED_NOMATCH,
                         ERROR
                     };

              xattr_list  must  be  set  to  NULL  before  calling  selinux_restorecon_xattr(3).   The caller is
              responsible for freeing the returned xattr_list entries in the linked list.

       See the NOTES section for more information.

RETURN VALUE

       On success, zero is returned.  On error, -1 is returned and errno is set appropriately.

NOTES

       1.  By  default  selinux_restorecon_xattr(3)  will  use  the  default  set  of  specfiles  described   in
           files_contexts(5)  to  calculate  the SHA1 digests to be used for comparison.  To change this default
           behavior selabel_open(3) must be called specifying the  required  SELABEL_OPT_PATH  and  setting  the
           SELABEL_OPT_DIGEST  option to a non-NULL value.  selinux_restorecon_set_sehandle(3) is then called to
           set the handle to be used by selinux_restorecon_xattr(3).

       2.  By default selinux_restorecon_xattr(3) reads /proc/mounts to obtain a list of non-seclabel mounts  to
           be excluded from searches unless the SELINUX_RESTORECON_XATTR_IGNORE_MOUNTS flag has been set.

       3.  RAMFS  and  TMPFS  filesystems  do  not  support  the  security.sehash  extended  attribute  and  are
           automatically excluded from searches.

       4.  By default stderr is used to log  output  messages  and  errors.  This  may  be  changed  by  calling
           selinux_set_callback(3) with the SELINUX_CB_LOG type option.

SEE ALSO

       selinux_restorecon(3)
       selinux_restorecon_set_sehandle(3),
       selinux_restorecon_default_handle(3),
       selinux_restorecon_set_exclude_list(3),
       selinux_restorecon_set_alt_rootpath(3),
       selinux_set_callback(3)

                                                  30 July 2016                       selinux_restorecon_xattr(3)