# selabel_x

## NAME



           selabel_x - userspace SELinux labeling interface and configuration
           file format for the X Window System contexts backend. This backend
           is also used to determine the default context for labeling
           remotely connected X clients
    


## SYNOPSIS



           **#include <selinux/label.h>**
    
           **int selabel_lookup(struct selabel_handle ***_hnd_**,**
                              **char ****_context_**,**
                              **const char ***_object_name_**, int** _object_type_**);**
    
           **int selabel_lookup_raw(struct selabel_handle ***_hnd_**,**
                              **char ****_context_**,**
                              **const char ***_object_name_**, int** _object_type_**);**
    


## DESCRIPTION



           The X contexts backend maps from X Window System object names into
           security contexts. It is used to find the appropriate context for
           X Window System objects whose significance and/or usage semantics
           are determined primarily by name. The returned _context_ must be
           freed using freecon(3).
           selabel_lookup(3) describes the function with its return and error
           codes.
    
           This backend is also used to determine the default context for
           labeling remotely connected X clients.
    
           The _object_type_ argument should be set to one of the following
           values:
    
                  **SELABEL_X_PROP**
                         The _object_name_ argument specifies the name of a
                         window property, such as "WM_NAME".
    
                  **SELABEL_X_SELN**
                         The _object_name_ argument specifies the name of a
                         selection, such as "PRIMARY".
    
                  **SELABEL_X_EXT**
                         The _object_name_ argument specifies the name of a
                         protocol extension, such as "RENDER".
    
                  **SELABEL_X_EVENT**
                         The _object_name_ argument specifies the name of an
                         event type, such as "X11:ButtonPress".
    
                  **SELABEL_X_CLIENT**
                         The _object_name_ argument is ignored, however it
                         should be set to either _*_ (an asterisk or 'wildcard'
                         that will select the default entry) or a specific
                         entry such as "remote" in the X contexts file as
                         shown in the **EXAMPLE** section. The default context
                         for labeling remote X clients is then returned.
    
                  **SELABEL_X_POLYPROP**
                         Like **SELABEL_X_PROP** , but checks if the property was
                         marked as being polyinstantiated. See **NOTES** below.
    
                  **SELABEL_X_POLYSELN**
                         Like **SELABEL_X_SELN** , but checks if the selection was
                         marked as being polyinstantiated. See **NOTES** below.
    
           Any messages generated by selabel_lookup(3) are sent to _stderr_ by
           default, although this can be changed by selinux_set_callback(3).
    
           **selabel_lookup_raw** behaves identically to **selabel_lookup** but does
           not perform context translation.
    
           The **FILES** section details the configuration files used to
           determine the X object context.
    


## OPTIONS



           In addition to the global options described in selabel_open(3),
           this backend recognizes the following options:
    
                  **SELABEL_OPT_PATH**
                         A non-null value for this option specifies a path to
                         a file that will be opened in lieu of the standard X
                         contexts file (see the **FILES** section for details).
    


## FILES



           The X context file used to retrieve a default context depends on
           the **SELABEL_OPT_PATH** parameter passed to selabel_open(3). If _NULL_ ,
           then the **SELABEL_OPT_PATH** value will default to the active policy
           X contexts location (as returned by selinux_x_context_path(3)),
           otherwise the actual **SELABEL_OPT_PATH** value specified is used.
    
           The default X object contexts file is:
                  _/etc/selinux/{SELINUXTYPE}/contexts/x_contexts_
    
           Where _{SELINUXTYPE}_ is the entry from the selinux configuration
           file _config_ (see selinux_config(5)).
    
           The entries within the X contexts file are shown in the **Object**
           **Name String Values** and **FILE FORMAT** sections.
    


## Object Name String Values



           The string name assigned to each _object_type_ argument that can be
           present in the X contexts file are:
                        ┌────────────────────┬────────────────┐
                        │ _object_type_        │ **Text Name** │
                        ├────────────────────┼────────────────┤
                        │ **SELABEL_X_PROP** │ property       │
                        ├────────────────────┼────────────────┤
                        │ **SELABEL_X_SELN** │ selection      │
                        ├────────────────────┼────────────────┤
                        │ **SELABEL_X_EXT** │ extension      │
                        ├────────────────────┼────────────────┤
                        │ **SELABEL_X_EVENT** │ event          │
                        ├────────────────────┼────────────────┤
                        │ **SELABEL_X_CLIENT** │ client         │
                        ├────────────────────┼────────────────┤
                        │ **SELABEL_X_POLYPROP** │ poly_property  │
                        ├────────────────────┼────────────────┤
                        │ **SELABEL_X_POLYSELN** │ poly_selection │
                        └────────────────────┴────────────────┘
    


## FILE FORMAT



           Each line within the X contexts file is as follows:
                  _object_type object_name context_
    
           Where:
                  _object_type_
                         This is the string representation of the object type
                         shown in the **Object Name String Values** section.
                         There can be multiple lines with the same
                         _object_type_ string that will form a block of entries
                         (each with a different _object_name_ entry).
                  _object_name_
                         These are the object names of the specific X-server
                         resource such as **PRIMARY** , **CUT_BUFFER0** etc. They are
                         generally defined in the X-server source code
                         (_protocol.txt_ and _BuiltInAtoms_ in the dix directory
                         of the xorg-server source package).  The entry can
                         contain '*' for wildcard matching or '?' for
                         substitution.  Note that if the '*' is used, then be
                         aware that the order of entries in the file is
                         important. The '*' on its own is used to ensure a
                         default fallback context is assigned and should be
                         the last entry in the _object_type_ block.
                  _context_
                         The security context that will be applied to the
                         object.
    
           Example 1:
    
           # object_type  object_name  context
           selection      PRIMARY      system_u:object_r:clipboard_xselection_t:s0
           selection      *            system_u:object_r:xselection_t:s0
    
           Example 2 - This example shows how a client entry can be
           configured to ensure an entry is always found:
    
           # object_type  object_name  context
           client         *            system_u:object_r:remote_t:s0
    


## NOTES



           1.  Properties and selections are marked as either
               polyinstantiated or not. For these name types, the "POLY"
               option searches only the names marked as being
               polyinstantiated, while the other option searches only the
               names marked as not being polyinstantiated. Users of the
               interface should check both mappings, optionally taking action
               based on the result (e.g. polyinstantiating the object).
    
           2.  If contexts are to be validated, then the global option
               **SELABEL_OPT_VALIDATE** must be set before calling
               selabel_open(3). If this is not set, then it is possible for
               an invalid context to be returned.
    


* * *