selinux

package

v1.15.1 Latest Latest Go to latest Published: Jun 1, 2026 License: Apache-2.0 Imports: 19 Imported by: 553

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/opencontainers/selinux

Links

Documentation ¶

Rendered for

Overview ¶

Package selinux provides a high-level interface for interacting with selinux.

Usage:

import "github.com/opencontainers/selinux/go-selinux"

// Ensure that selinux is enforcing mode.
if selinux.EnforceMode() != selinux.Enforcing {
	selinux.SetEnforceMode(selinux.Enforcing)
}

Index ¶

Constants
Variables
func CalculateGlbLub(sourceRange, targetRange string) (string, error)
func CanonicalizeContext(val string) (string, error)
func Chcon(fpath string, label string, recurse bool) error
func CheckLabel(label string) error
func ClassIndex(class string) (int, error)
func ClearLabels()
func ComputeCreateContext(source string, target string, class string) (string, error)
func ContainerLabels() (processLabel string, fileLabel string)deprecated
func CopyLevel(src, dest string) (string, error)
func CurrentLabel() (string, error)
func DefaultEnforceMode() int
func DisableSecOpt() []string
func DupSecOpt(src string) ([]string, error)
func EnforceMode() int
func ExecLabel() (string, error)
func FSCreateLabel() (string, error)
func FileLabel(fpath string) (string, error)
func GetDefaultContextWithLevel(user, level, scon string) (string, error)
func GetEnabled() bool
func InitContainerLabel() (string, error)
func InitContainerLabels() (string, string)deprecated
func KVMContainerLabel() (string, error)
func KVMContainerLabels() (string, string)deprecated
func KeyLabel() (string, error)
func LfileLabel(fpath string) (string, error)
func LsetFileLabel(fpath string, label string) error
func MLSEnabled() bool
func PeerLabel(fd uintptr) (string, error)
func PidLabel(pid int) (string, error)
func PrivContainerMountLabel() string
func ROFileLabel() stringdeprecated
func ReleaseLabel(label string)
func ReserveLabel(label string)deprecated
func ReserveLabelV2(label string) error
func SEUserByName(username string) (seUser string, level string, err error)
func SecurityCheckContext(val string) error
func SetCategoryRange(upper uint32) error
func SetDisabled()
func SetEnforceMode(mode int) error
func SetExecLabel(label string) error
func SetFSCreateLabel(label string) error
func SetFileLabel(fpath string, label string) error
func SetKeyLabel(label string) error
func SetProcessKind(label string, kind ProcessKind) (string, error)
func SetSocketLabel(label string) error
func SetTaskLabel(label string) error
func SocketLabel() (string, error)
type Context
- func NewContext(label string) (Context, error)
- func (c Context) Get() string
type ProcessKind

Constants ¶

View Source

const (
	// Enforcing constant indicate SELinux is in enforcing mode
	Enforcing = 1
	// Permissive constant to indicate SELinux is in permissive mode
	Permissive = 0
	// Disabled constant to indicate SELinux is disabled
	Disabled = -1

	// DefaultCategoryRange is the upper bound on the category range
	DefaultCategoryRange = uint32(maxCategory)
)

Variables ¶

View Source

var (
	// ErrMCSAlreadyExists is returned when trying to allocate a duplicate MCS.
	ErrMCSAlreadyExists = errors.New("MCS label already exists")
	// ErrEmptyPath is returned when an empty path has been specified.
	ErrEmptyPath = errors.New("empty path")

	// ErrInvalidLabel is returned when an invalid label is specified.
	ErrInvalidLabel = errors.