Crate selinux_sys 

selinux-sys: Unsafe Rust bindings for libselinux

SELinux is a flexible Mandatory Access Control (MAC) for Linux.

This crate exposes neither deprecated nor undocumented SELinux API functions and types.

This crate is specific to Android and some Linux distributions. Building it for other platforms, or for the Linux kernel, results in an empty crate.

Supported environment variables

This crate depends on some environment variables, and variants of those. For each environment variable (e.g., CC), the following are the accepted variants of it:

• <var>_<target>, e.g., CC_aarch64-unknown-linux-gnu.
• <var>_<target-with-underscores>, e.g., CC_aarch64_unknown_linux_gnu.
• TARGET_<var>, e.g., TARGET_CC.
• <var>, e.g., CC.

The following environment variables (and their variants) affect how this crate is built:

• SELINUX_STATIC
• SELINUX_PATH
• SELINUX_INCLUDE_DIR
• SELINUX_LIB_DIR
• SYSROOT
• CC
• CFLAGS

Dynamic or static linking

This crate links to libselinux dynamically if possible, except when targeting platforms based on the musl C library.

This behavior can be changed either by setting the environment variable SELINUX_STATIC to 1, or by enabling the crate feature static. If both are defined, then the value of SELINUX_STATIC takes precedence.

Setting SELINUX_STATIC to 0 mandates dynamic linking.

Finding SELinux library and headers

By default, this crate finds SELinux headers and library based on the default target C compiler.

This behavior can be changed by:

• Either defining the environment variable SELINUX_PATH to the path of a directory containing the sub-directories include and lib where the headers and library are installed.
• Or by defining one or both of the environment variables SELINUX_INCLUDE_DIR and SELINUX_LIB_DIR to paths to the directories where headers and library are present. If SELINUX_PATH is also defined, then SELINUX_INCLUDE_DIR and SELINUX_LIB_DIR take precedence.

Depending on this crate

This crate provides the following variables to other crates that depend on it:

• DEP_SELINUX_INCLUDE: Path of the directory where library C header files reside.
• DEP_SELINUX_LIB: Path of the directory where the library binary resides.

Versioning

This project adheres to Semantic Versioning. The CHANGELOG.md file details notable changes over time.

Modules

digest_result

selabel_cmp_result

Structs

SELboolean

av_decision

avc_cache_stats

avc_entry

avc_entry_ref

avc_lock_callback

avc_log_callback

avc_memory_callback

avc_thread_callback

context_s_t

dir_xattr

security_class_mapping

security_id

selabel_handle

selinux_opt

Constants

AVC_CACHE_STATS

AVC_CALLBACK_AUDITALLOW_DISABLE

AVC_CALLBACK_AUDITALLOW_ENABLE

AVC_CALLBACK_AUDITDENY_DISABLE

AVC_CALLBACK_AUDITDENY_ENABLE

AVC_CALLBACK_GRANT

AVC_CALLBACK_RESET

AVC_CALLBACK_REVOKE

AVC_CALLBACK_TRY_REVOKE

AVC_OPT_SETENFORCE

AVC_OPT_UNUSED

MATCHPATHCON_BASEONLY

MATCHPATHCON_NOTRANS

MATCHPATHCON_VALIDATE

SECSID_WILD

Unspecified SID.

SELABEL_CTX_ANDROID_PROP

SELABEL_CTX_ANDROID_SERVICE

SELABEL_CTX_DB

SELABEL_CTX_FILE

SELABEL_CTX_MEDIA

SELABEL_CTX_X

SELABEL_DB_BLOB

SELABEL_DB_COLUMN

SELABEL_DB_DATABASE

SELABEL_DB_DATATYPE

SELABEL_DB_EXCEPTION

SELABEL_DB_LANGUAGE

SELABEL_DB_PROCEDURE

SELABEL_DB_SCHEMA

SELABEL_DB_SEQUENCE

SELABEL_DB_TABLE

SELABEL_DB_TUPLE

SELABEL_DB_VIEW

SELABEL_NOPT

SELABEL_OPT_BASEONLY

SELABEL_OPT_DIGEST

SELABEL_OPT_PATH

SELABEL_OPT_SUBSET

SELABEL_OPT_UNUSED

SELABEL_OPT_VALIDATE

SELABEL_X_CLIENT

SELABEL_X_EVENT

SELABEL_X_EXT

SELABEL_X_POLYPROP

SELABEL_X_POLYSELN

SELABEL_X_PROP

SELABEL_X_SELN

SELINUX_AVC

SELINUX_AVD_FLAGS_PERMISSIVE

SELINUX_CB_AUDIT

SELINUX_CB_LOG

SELINUX_CB_POLICYLOAD

SELINUX_CB_SETENFORCE

SELINUX_CB_VALIDATE

SELINUX_DEFAULTUSER

SELINUX_ERROR

SELINUX_INFO

SELINUX_POLICYLOAD

SELINUX_RESTORECON_ABORT_ON_ERROR

SELINUX_RESTORECON_ADD_ASSOC

SELINUX_RESTORECON_CONFLICT_ERROR

SELINUX_RESTORECON_COUNT_ERRORS

SELINUX_RESTORECON_IGNORE_DIGEST

SELINUX_RESTORECON_IGNORE_MOUNTS

SELINUX_RESTORECON_IGNORE_NOENTRY

SELINUX_RESTORECON_LOG_MATCHES

SELINUX_RESTORECON_MASS_RELABEL

SELINUX_RESTORECON_NOCHANGE

SELINUX_RESTORECON_PROGRESS

SELINUX_RESTORECON_REALPATH

SELINUX_RESTORECON_RECURSE

SELINUX_RESTORECON_SET_SPECFILE_CTX

SELINUX_RESTORECON_SET_USER_ROLE

SELINUX_RESTORECON_SKIP_DIGEST

SELINUX_RESTORECON_SYSLOG_CHANGES

SELINUX_RESTORECON_VERBOSE

SELINUX_RESTORECON_XATTR_DELETE_ALL_DIGESTS

SELINUX_RESTORECON_XATTR_DELETE_NONMATCH_DIGESTS

SELINUX_RESTORECON_XATTR_IGNORE_MOUNTS

SELINUX_RESTORECON_XATTR_RECURSE

SELINUX_RESTORECON_XDEV

SELINUX_SETENFORCE

SELINUX_TRANS_DIR

SELINUX_WARNING

Functions

avc_add_callback^⚠

avc_audit^⚠

avc_av_stats^⚠

avc_cache_stats^⚠

avc_cleanup^⚠

avc_compute_create^⚠

avc_compute_member^⚠

avc_context_to_sid^⚠

avc_context_to_sid_raw^⚠

avc_destroy^⚠

avc_entry_ref_init^⚠

Initialize an avc_entry_ref structure.

avc_get_initial_sid^⚠

avc_has_perm^⚠

avc_has_perm_noaudit^⚠

avc_netlink_acquire_fd^⚠

avc_netlink_check_nb^⚠

avc_netlink_close^⚠

avc_netlink_loop^⚠

avc_netlink_open^⚠

avc_netlink_release_fd^⚠

avc_open^⚠

avc_reset^⚠

avc_sid_stats^⚠

avc_sid_to_context^⚠

avc_sid_to_context_raw^⚠

context_free^⚠

context_new^⚠

context_range_get^⚠

context_range_set^⚠

context_role_get^⚠

context_role_set^⚠

context_str^⚠

context_to_str^⚠

context_type_get^⚠

context_type_set^⚠

context_user_get^⚠

context_user_set^⚠

fgetfilecon^⚠

fgetfilecon_raw^⚠

fini_selinuxmnt^⚠

freecon^⚠

freeconary^⚠

fsetfilecon^⚠

fsetfilecon_raw^⚠

get_default_context^⚠

get_default_context_with_level^⚠

get_default_context_with_role^⚠

get_default_context_with_rolelevel^⚠

get_default_type^⚠

get_ordered_context_list^⚠

get_ordered_context_list_with_level^⚠

getcon^⚠

getcon_raw^⚠

getexeccon^⚠

getexeccon_raw^⚠

getfilecon^⚠

getfilecon_raw^⚠

getfscreatecon^⚠

getfscreatecon_raw^⚠

getkeycreatecon^⚠

getkeycreatecon_raw^⚠

getpeercon^⚠

getpeercon_raw^⚠

getpidcon^⚠

getpidcon_raw^⚠

getprevcon^⚠

getprevcon_raw^⚠

getseuser^⚠

getseuserbyname^⚠

getsockcreatecon^⚠

getsockcreatecon_raw^⚠

is_context_customizable^⚠

is_selinux_enabled^⚠

is_selinux_mls_enabled^⚠

lgetfilecon^⚠

lgetfilecon_raw^⚠

lsetfilecon^⚠

lsetfilecon_raw^⚠

manual_user_enter_context^⚠

matchmediacon^⚠

matchpathcon_checkmatches^⚠

matchpathcon_filespec_add^⚠

matchpathcon_filespec_destroy^⚠

matchpathcon_filespec_eval^⚠

mode_to_security_class^⚠

print_access_vector^⚠

query_user_context^⚠

security_av_perm_to_string^⚠

security_av_string^⚠

security_canonicalize_context^⚠

security_canonicalize_context_raw^⚠

security_check_context^⚠

security_check_context_raw^⚠

security_class_to_string^⚠

security_commit_booleans^⚠

security_compute_av^⚠

security_compute_av_flags^⚠

security_compute_av_flags_raw^⚠

security_compute_av_raw^⚠

security_compute_create^⚠

security_compute_create_name^⚠

security_compute_create_name_raw^⚠

security_compute_create_raw^⚠

security_compute_member^⚠

security_compute_member_raw^⚠

security_compute_relabel^⚠

security_compute_relabel_raw^⚠

security_deny_unknown^⚠

security_disable^⚠

security_get_boolean_active^⚠

security_get_boolean_names^⚠

security_get_boolean_pending^⚠

security_get_checkreqprot^⚠

security_get_initial_context^⚠

security_get_initial_context_raw^⚠

security_getenforce^⚠

security_load_policy^⚠

security_policyvers^⚠

security_reject_unknown^⚠

security_set_boolean^⚠

security_set_boolean_list^⚠

security_setenforce^⚠

security_validatetrans^⚠

security_validatetrans_raw^⚠

selabel_close^⚠

selabel_cmp^⚠

selabel_digest^⚠

selabel_get_digests_all_partial_matches^⚠

selabel_hash_all_partial_matches^⚠

selabel_lookup^⚠

selabel_lookup_best_match^⚠

selabel_lookup_best_match_raw^⚠

selabel_lookup_raw^⚠

selabel_open^⚠

selabel_partial_match^⚠

selabel_stats^⚠

selinux_binary_policy_path^⚠

selinux_boolean_sub^⚠

selinux_booleans_subs_path^⚠

selinux_check_access^⚠

selinux_check_securetty_context^⚠

selinux_colors_path^⚠

selinux_contexts_path^⚠

selinux_current_policy_path^⚠

selinux_customizable_types_path^⚠

selinux_default_context_path^⚠

selinux_default_type_path^⚠

selinux_failsafe_context_path^⚠

selinux_file_context_cmp^⚠

selinux_file_context_homedir_path^⚠

selinux_file_context_local_path^⚠

selinux_file_context_path^⚠

selinux_file_context_subs_dist_path^⚠

selinux_file_context_subs_path^⚠

selinux_file_context_verify^⚠

selinux_flush_class_cache^⚠

selinux_get_callback^⚠

selinux_getenforcemode^⚠

selinux_getpolicytype^⚠

selinux_homedir_context_path^⚠

selinux_init_load_policy^⚠

selinux_lsetfilecon_default^⚠

selinux_lxc_contexts_path^⚠

selinux_media_context_path^⚠

selinux_mkload_policy^⚠

selinux_netfilter_context_path^⚠

selinux_openrc_contexts_path^⚠

selinux_openssh_contexts_path^⚠

selinux_path^⚠

selinux_policy_root^⚠

selinux_raw_context_to_color^⚠

selinux_raw_to_trans_context^⚠

selinux_removable_context_path^⚠

selinux_reset_config^⚠

selinux_restorecon^⚠

selinux_restorecon_default_handle^⚠

selinux_restorecon_get_skipped_errors^⚠

selinux_restorecon_parallel^⚠

selinux_restorecon_set_alt_rootpath^⚠

selinux_restorecon_set_exclude_list^⚠

selinux_restorecon_set_sehandle^⚠

selinux_restorecon_xattr^⚠

selinux_securetty_types_path^⚠

selinux_sepgsql_context_path^⚠

selinux_set_callback^⚠

selinux_set_mapping^⚠

selinux_set_policy_root^⚠

selinux_snapperd_contexts_path^⚠

selinux_status_close^⚠

selinux_status_deny_unknown^⚠

selinux_status_getenforce^⚠

selinux_status_open^⚠

selinux_status_policyload^⚠

selinux_status_updated^⚠

selinux_systemd_contexts_path^⚠

selinux_trans_to_raw_context^⚠

selinux_translations_path^⚠

selinux_user_contexts_path^⚠

selinux_usersconf_path^⚠

selinux_virtual_domain_context_path^⚠

selinux_virtual_image_context_path^⚠

selinux_x_context_path^⚠

set_matchpathcon_canoncon^⚠

set_matchpathcon_flags^⚠

set_matchpathcon_invalidcon^⚠

set_matchpathcon_printf^⚠

set_selinuxmnt^⚠

setcon^⚠

setcon_raw^⚠

setexeccon^⚠

setexeccon_raw^⚠

setfilecon^⚠

setfilecon_raw^⚠

setfscreatecon^⚠

setfscreatecon_raw^⚠

setkeycreatecon^⚠

setkeycreatecon_raw^⚠

setsockcreatecon^⚠

setsockcreatecon_raw^⚠

string_to_av_perm^⚠

string_to_security_class^⚠

Type Aliases

__ino_t

__mode_t

__pid_t

access_vector_t

context_t

ino_t

mode_t

pid_t

security_class_t

security_id_t

Unions

selinux_callback