# selabel_media

## NAME



           selabel_media - userspace SELinux labeling interface and
           configuration file format for the media contexts backend
    


## SYNOPSIS



           **#include <selinux/label.h>**
    
           **int selabel_lookup(struct selabel_handle ***_hnd_**,**
                              **char ****_context_**,**
                              **const char ***_device_name_**, int** _unused_**);**
    
           **int selabel_lookup_raw(struct selabel_handle ***_hnd_**,**
                              **char ****_context_**,**
                              **const char ***_device_name_**, int** _unused_**);**
    


## DESCRIPTION



           The media contexts backend maps from media device names such as
           "cdrom" or "floppy" into security contexts. It is used to find the
           appropriate context for establishing context mounts on these
           devices. The returned _context_ must be freed using freecon(3).
           selabel_lookup(3) describes the function with its return and error
           codes.
    
           The integer lookup argument is currently unused and should be set
           to zero.
    
           Any messages generated by selabel_lookup(3) are sent to _stderr_ by
           default, although this can be changed by selinux_set_callback(3).
    
           selabel_lookup_raw(3) behaves identically to selabel_lookup(3) but
           does not perform context translation.
    
           The **FILES** section details the configuration files used to
           determine the media context.
    


## OPTIONS



           In addition to the global options described in selabel_open(3),
           this backend recognizes the following options:
    
           **SELABEL_OPT_PATH**
                  A non-null value for this option specifies a path to a file
                  that will be opened in lieu of the standard _media_ contexts
                  file.
    


## FILES



           The media context file used to retrieve a default context depends
           on the **SELABEL_OPT_PATH** parameter passed to **selabel_open(3). If**
           _NULL_ , then the **SELABEL_OPT_PATH** value will default to the active
           policy media contexts location (as returned by
           selinux_media_context_path(3)), otherwise the actual
           **SELABEL_OPT_PATH** value specified is used.
    
           The default media contexts file is:
                  _/etc/selinux/{SELINUXTYPE}/contexts/files/media_
    
           Where _{SELINUXTYPE}_ is the entry from the selinux configuration
           file _config_ (see selinux_config(5)).
    


## FILE FORMAT



           Each line within the _media_ file is as follows:
                  _device_name context_
    
           Where:
                  _device_name_
                         The media identifier (e.g. cdrom, floppy, disk and
                         usb).
                  _context_
                         The context to be used for labeling the device.
    
           Example:
                  # contexts/files/media
                  cdrom system_u:object_r:removable_device_t
                  floppy system_u:object_r:removable_device_t
                  disk system_u:object_r:fixed_disk_device_t
    


## NOTES



           If contexts are to be validated, then the global option
           **SELABEL_OPT_VALIDATE** must be set before calling selabel_open(3).
           If this is not set, then it is possible for an invalid context to
           be returned.
    


* * *