---
name: "get_ordered_context_list_with_level"
section: "3"
platform: "linux"
package: "libselinux1-dev"
version: "3.8.1-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/get_ordered_context_list"
---

# get\_ordered\_context\_list\_with\_level(3)

determine SELinux context(s) for user sessions

Part of [get\_ordered\_context\_list(3)](/get_ordered_context_list/3.md).

## NAME

get\_ordered\_context\_list, get\_ordered\_context\_list\_with\_level, get\_default\_context, get\_default\_context\_with\_level, get\_default\_context\_with\_role, get\_default\_context\_with\_rolelevel, query\_user\_context, manual\_user\_enter\_context, get\_default\_role - determine SELinux context(s) for user sessions

## SYNOPSIS

**#include \<selinux/selinux.h\>**\
 **#include \<selinux/get\_context\_list.h\>**

**int get\_ordered\_context\_list(const char \****user***, const char \****fromcon***, char \*\*\****list***);**

**int get\_ordered\_context\_list\_with\_level(const char \****user***, const char \****level***, const char \****fromcon***, char \*\*\****list***);**

**int get\_default\_context(const char \****user***, const char \****fromcon***, char \*\****newcon***);**

**int get\_default\_context\_with\_level(const char \****user***, const char \****level***, const char \****fromcon***, char \*\****newcon***);**

**int get\_default\_context\_with\_role(const char \****user***, const char \****role***, const char \****fromcon***, char \*\****newcon***);**

**int get\_default\_context\_with\_rolelevel(const char \****user***, const char \****role***, const char \****level***, const char \****fromcon***, char \*\****newcon***);**

**int query\_user\_context(char \*\****list***, char \*\****newcon***);**

**int manual\_user\_enter\_context(const char \****user***, char \*\****newcon***);**

**int get\_default\_type(const char \****role***, char \*\****type***);**

## DESCRIPTION

This family of functions can be used to obtain either a prioritized list of all reachable security contexts for a given SELinux user or a single default (highest priority) context for a given SELinux user for use by login-like programs. These functions takes a SELinux user identity that must be defined in the SELinux policy as their input, not a Linux username. Most callers should typically first call [**getseuserbyname**(3)](/getseuserbyname/3.md) to look up the SELinux user identity and level for a given Linux username and then invoke one of **get\_ordered\_context\_list\_with\_level**() or **get\_default\_context\_with\_level**() with the returned SELinux user and level as inputs.

**get\_ordered\_context\_list**() obtains the list of contexts for the specified SELinux *user* identity that are reachable from the specified *fromcon* context based on the global */etc/selinux/{SELINUXTYPE}/contexts/default\_contexts* file and the per-user */etc/selinux/{SELINUXTYPE}/contexts/users/\<username\>* file if it exists. The *fromcon* parameter may be NULL to indicate that the current context should be used. The function returns the number of contexts in the list, or -1 upon errors. The list must be freed using the [**freeconary**(3)](/freeconary/3.md) function.

**get\_ordered\_context\_list\_with\_level**() invokes the **get\_ordered\_context\_list**() function and applies the specified level.

**get\_default\_context**() is the same as **get\_ordered\_context\_list**() but only returns a single context which has to be freed with [**freecon**(3)](/freecon/3.md).

**get\_default\_context\_with\_level**() invokes the **get\_default\_context**() function and applies the specified level.

**get\_default\_context\_with\_role**() is the same as **get\_default\_context**() but only returns a context with the specified role, returning -1 if no such context is reachable for the user.

**get\_default\_context\_with\_rolelevel**() invokes the **get\_default\_context\_with\_role**() function and applies the specified level.

**query\_user\_context**() takes a list of contexts, queries the user via stdin/stdout as to which context they want, and returns a new context as selected by the user (which has to be freed with [**freecon**(3)](/freecon/3.md)).

**manual\_user\_enter\_context**() allows the user to manually enter a context as a fallback if a list of authorized contexts could not be obtained. Caller must free via [**freecon**(3)](/freecon/3.md).

**get\_default\_type**() Get the default type (domain) for *role* and set *type* to refer to it, which has to be freed with free.

## RETURN VALUE

**get\_ordered\_context\_list**() and **get\_ordered\_context\_list\_with\_level**() return the number of contexts in the list upon success or -1 upon errors. The other functions return 0 for success or -1 for errors.

## SEE ALSO

[**selinux**(8)](/selinux/8.md), [**freeconary**(3)](/freeconary/3.md), [**freecon**(3)](/freecon/3.md), [**security\_compute\_av**(3)](/security_compute_av/3.md), [**getseuserbyname**(3)](/getseuserbyname/3.md)