---
name: "matchpathcon"
section: "3"
platform: "linux"
package: "libselinux1-dev"
version: "3.8.1-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/matchpathcon/3"
---

# matchpathcon(3)

get the default SELinux security context for the specified path from the file contexts configuration

## NAME

matchpathcon, matchpathcon\_index - get the default SELinux security context for the specified path from the file contexts configuration

## SYNOPSIS

**#include \<selinux/selinux.h\>**

**int matchpathcon\_init(const char \****path***);**

**int matchpathcon\_init\_prefix(const char \****path***, const char \****prefix***);**

**int matchpathcon\_fini(void);**

**int matchpathcon(const char \****path***, mode\_t** *mode***, char \*\****con***);**

**int matchpathcon\_index(const char \****name***, mode\_t** *mode***, char \*\****con***);**

## DESCRIPTION

This family of functions is deprecated. For new code, please use [**selabel\_open**(3)](/selabel_open/3.md) with the **SELABEL\_CTX\_FILE** backend in place of **matchpathcon\_init**(), use [**selabel\_close**(3)](/selabel_close/3.md) in place of **matchpathcon\_fini**(), and use [**selabel\_lookup**(3)](/selabel_lookup/3.md) in place of **matchpathcon**().

The remaining description below is for the legacy interface.

**matchpathcon\_init**() loads the file contexts configuration specified by *path* into memory for use by subsequent **matchpathcon**() calls. If *path* is NULL, then the active file contexts configuration is loaded by default, i.e., the path returned by [**selinux\_file\_context\_path**(3)](/selinux_file_context_path/3.md). Unless the **MATCHPATHCON\_BASEONLY** flag has been set via [**set\_matchpathcon\_flags**(3)](/set_matchpathcon_flags/3.md), files with the same path prefix but a **.homedirs** and **.local** suffix are also looked up and loaded if present. These files provide dynamically generated entries for user home directories and for local customizations.

**matchpathcon\_init\_prefix**() is the same as **matchpathcon\_init**() but only loads entries with regular expressions whose first pathname component is a prefix of *prefix*, e.g., pass "/dev" if you only intend to call **matchpathcon**() with pathnames beginning with /dev. However, this optimization is no longer necessary due to the use of *file\_contexts.bin* files with precompiled regular expressions, so use of this interface is deprecated.

**matchpathcon\_fini**() frees the memory allocated by a prior call to **matchpathcon\_init**(). This function can be used to free and reset the internal state between multiple **matchpathcon\_init**() calls, or to free memory when finished using **matchpathcon**().

**matchpathcon**() matches the specified *pathname*, after transformation via [**realpath**(3)](/realpath/3.md) excepting any final symbolic link component if S\_IFLNK was specified as the *mode*, and *mode* against the *file contexts* configuration and sets the security context *con* to refer to the resulting context. The caller must free the returned security context *con* using [**freecon**(3)](/freecon/3.md) when finished using it. *mode* can be 0 to disable mode matching, but should be provided whenever possible, as it may affect the matching. Only the file format bits (i.e., the file type) of the *mode* are used. If **matchpathcon\_init**() has not already been called, then this function will call it upon its first invocation with a NULL *path*, defaulting to the active file contexts configuration.

**matchpathcon\_index**() is the same as **matchpathcon**() but returns a specification index that can later be used in a [**matchpathcon\_filespec\_add**(3)](/matchpathcon_filespec_add/3.md) call.

## RETURN VALUE

Returns zero on success or -1 otherwise.

## SEE ALSO

[**selinux**(8)](/selinux/8.md), [**set\_matchpathcon\_flags**(3)](/set_matchpathcon_flags/3.md), [**set\_matchpathcon\_invalidcon**(3)](/set_matchpathcon_invalidcon/3.md), [**set\_matchpathcon\_printf**(3)](/set_matchpathcon_printf/3.md), [**matchpathcon\_filespec\_add**(3)](/matchpathcon_filespec_add/3.md), [**matchpathcon\_checkmatches**(3)](/matchpathcon_checkmatches/3.md), [**freecon**(3)](/freecon/3.md), [**setfilecon**(3)](/setfilecon/3.md), [**setfscreatecon**(3)](/setfscreatecon/3.md)