NAME

       selinux_restorecon_xattr - manage default security.sehash extended attribute entries added
       by selinux_restorecon(3), setfiles(8) or restorecon(8).

SYNOPSIS

       #include <selinux/restorecon.h>

       int selinux_restorecon_xattr(const char *pathname,
                              unsigned int xattr_flags,
                              struct dir_xattr ***xattr_list);

DESCRIPTION

       selinux_restorecon_xattr() returns  a  linked  list  of  dir_xattr  structures  containing
       information described below based on:

              pathname  containing  a  directory tree to be searched for security.sehash extended
              attribute entries.

              xattr_flags contains options as follows:

                     SELINUX_RESTORECON_XATTR_RECURSE recursively descend directories.

                     SELINUX_RESTORECON_XATTR_DELETE_NONMATCH_DIGESTS delete non-matching digests
                     from each directory in pathname.

                     SELINUX_RESTORECON_XATTR_DELETE_ALL_DIGESTS  delete  all  digests  from each
                     directory in pathname.

                     SELINUX_RESTORECON_XATTR_IGNORE_MOUNTS do not read /proc/mounts to obtain  a
                     list of non-seclabel mounts to be excluded from the search.
                     Setting  SELINUX_RESTORECON_XATTR_IGNORE_MOUNTS  is  useful where there is a
                     non-seclabel fs mounted with a seclabel fs  mounted  on  a  directory  below
                     this.

              xattr_list  is  the returned pointer to a linked list of dir_xattr structures, each
              containing the following information:

                     struct dir_xattr {
                         char *directory;
                         char *digest;    /* Printable hex encoded string */
                         enum digest_result result;
                         struct dir_xattr *next;
                     };

              The result entry is enumerated as follows:
                     enum digest_result {
                         MATCH = 0,
                         NOMATCH,
                         DELETED_MATCH,
                         DELETED_NOMATCH,
                         ERROR
                     };

              xattr_list must be set to NULL  before  calling  selinux_restorecon_xattr(3).   The
              caller  is  responsible  for  freeing the returned xattr_list entries in the linked
              list.

       See the NOTES section for more information.

RETURN VALUE

       On success, zero is returned.  On error, -1 is returned and errno is set appropriately.

NOTES

       1.  By default selinux_restorecon_xattr(3) will use the default set of specfiles described
           in  files_contexts(5)  to  calculate  the  SHA1 digests to be used for comparison.  To
           change this default behavior selabel_open(3) must be called  specifying  the  required
           SELABEL_OPT_PATH  and  setting  the  SELABEL_OPT_DIGEST  option  to  a non-NULL value.
           selinux_restorecon_set_sehandle(3) is then called to set the  handle  to  be  used  by
           selinux_restorecon_xattr(3).

       2.  By  default  selinux_restorecon_xattr(3)  reads  /proc/mounts to obtain a list of non-
           seclabel    mounts     to     be     excluded     from     searches     unless     the
           SELINUX_RESTORECON_XATTR_IGNORE_MOUNTS flag has been set.

       3.  RAMFS  and TMPFS filesystems do not support the security.sehash extended attribute and
           are automatically excluded from searches.

       4.  By default stderr is used to log output messages and errors. This may  be  changed  by
           calling selinux_set_callback(3) with the SELINUX_CB_LOG type option.

SEE ALSO

       selinux_restorecon(3)
       selinux_restorecon_set_sehandle(3),
       selinux_restorecon_default_handle(3),
       selinux_restorecon_set_exclude_list(3),
       selinux_restorecon_set_alt_rootpath(3),
       selinux_set_callback(3)

                                           30 July 2016               selinux_restorecon_xattr(3)