SELinux is a flexible Mandatory Access Control for Linux.
This crate supports
libselinux from version
Later versions might still be compatible.
This crate exposes neither deprecated nor undocumented SELinux API functions
⚠️ This crate is Linux-specific. Building it for non-Linux platforms, or for the Linux kernel, results in an empty crate.
This documentation is too brief to cover SELinux.
Please refer to the official SELinux documentation, the manual pages of
libselinux native library, and the
selinux-sys crate for a more
complete picture on how to use this crate.
If you cannot find a feature you are looking for by its name, but you know
libselinux APIs relate to it, then try searching the documentation
by that API name.
This crate requires
2.8, at least.
However, this crate provides some functions that are based on
functions implemented in later versions.
When such newer functions are needed, this crate attempts to load them
dynamically at runtime.
If such functions are implemented by
libselinux, then the called crate
functions run as expected.
If the needed functions are not implemented by
libselinux, then an error is
returned indicating that the called crate function is unsupported.
This project adheres to Semantic Versioning.
CHANGELOG.md file details notable changes over time.
This section is only relevant for developers contributing to this crate, and not for users of this crate.
💡 If you’re developing this crate and feel important information is missing in this section, then please create an issue or a pull request to fix that.
This crate uses only
cargo as a build system. Usual commands are used to
perform most operations, e.g.,
Code is read many time more that written, so this crate’s code is always formatted using
Operations requiring special handling are crafted as cargo xtask targets. The full list of these special operations can be determined by running:
$ cargo xtask
Each special operation can be executed by running:
$ cargo xtask <operation> [parameters...]
For example, to generate coverage information, run:
$ cargo xtask coverage
This crate can only be tested on a Linux distribution that has SELinux supported and enabled at multiple levels:
- The Linux kernel must support SELinux, and have it enabled.
- The file system must be correctly configured.
- The user space must have access to SELinux, usually via
Given that coverage information requires running tests, that information can only be successfully obtained on a system with SELinux enabled.
This crate uses the
libselinux API as documented in the manual pages.
It tries to avoid assumptions about implementation details as far as possible,
even when performance might be improved with such knowledge.
The structures and enumerations defined by this crate assume that their user
might, at some point, decide to call raw
libselinux APIs (possible using
selinux-sys crate) for features not yet provided by this crate, or for
some other reasons. That is the reason why methods such as
implemented by these structures, exposing the raw values that
The change log is useful to get a picture of what is going on with the crate in the recent past.
- Access Vector Cache.
- SELinux call backs.
- Restore file(s) default SELinux security contexts.
- Labeling files.
- SELinux paths.
- SELinux policies.
- File access mode.
- Background and foreground colors.
- Opaque security context.
- Red, green and blue components of a color.
- SELinux security class.
- SELinux security context.
- Colors of a security context.
- List of security contexts.
- Support of SELinux in the running kernel.
- Protection checked by SELinux on
- SELinux enforcing mode.
- SELinux handling of undefined object classes and permissions.
- Determine how the system was set up to run SELinux.
- Determine the current SELinux enforcing mode.
- Get the default type (domain) for role, and set type to refer to it.
- Flush the SELinux class cache, e.g., upon a policy reload.
- Determine the support of SELinux in the running kernel.
- Determine the protection currently checked by SELinux on
- Force a reset of the loaded configuration.
- Get the SELinux user name and level for a given Linux user name.
- Set the current SELinux enforcing mode.
- Establishes a mapping from a user-provided ordering of object classes and permissions to the numbers actually used by the loaded system policy.
- Return the current SELinux handling of undefined object classes and permissions.