---
name: "selabel_close"
section: "3"
platform: "linux"
package: "libselinux1-dev"
version: "3.8.1-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/selabel_open"
---

# selabel\_close(3)

userspace SELinux labeling interface

Part of [selabel\_open(3)](/selabel_open/3.md).

## NAME

selabel\_open, selabel\_close - userspace SELinux labeling interface

## SYNOPSIS

**#include \<selinux/selinux.h\>**\
 **#include \<selinux/label.h\>**

**struct selabel\_handle \*selabel\_open(unsigned int** *backend***,** **const struct selinux\_opt \****options***,**\
 **unsigned** *nopt***);**

**void selabel\_close(struct selabel\_handle \****hnd***);**

## DESCRIPTION

**selabel\_open**() is used to initialize a labeling handle to be used for lookup operations.  The  *backend* argument specifies which backend is to be opened; the list of current backends appears in  **BACKENDS** below.

The  *options* argument should be NULL or a pointer to an array of  **selinux\_opt** structures of length *nopt*:

```
struct selinux_opt {
	int	type;
	const char	*value;
};
```

The available option types are described in  **GLOBAL OPTIONS** below as well as in the documentation for each individual backend.  The return value on success is a non-NULL value for use in subsequent label operations.

**selabel\_close**() terminates use of a handle, freeing any internal resources associated with it.  After this call has been made, the handle must not be used again.

## GLOBAL OPTIONS

Global options which may be passed to **selabel\_open**() include the following:

- **SELABEL\_OPT\_UNUSED**

  The option with a type code of zero is a no-op.  Thus an array of options may be initizalized to zero and any untouched elements will not cause an error.

- **SELABEL\_OPT\_VALIDATE**

  A non-null value for this option enables context validation.  By default, [**security\_check\_context**(3)](/security_check_context/3.md) is used; a custom validation function can be provided via [**selinux\_set\_callback**(3)](/selinux_set_callback/3.md). Note that an invalid context may not be treated as an error unless it is actually encountered during a lookup operation.

- **SELABEL\_OPT\_DIGEST**

  A non-null value for this option enables the generation of an SHA1 digest of the spec files loaded as described in [**selabel\_digest**(3)](/selabel_digest/3.md)

## BACKENDS

- **SELABEL\_CTX\_FILE**

  File contexts backend, described in  [**selabel\_file**(5)](/selabel_file/5.md).

- **SELABEL\_CTX\_MEDIA**

  Media contexts backend, described in  [**selabel\_media**(5)](/selabel_media/5.md).

- **SELABEL\_CTX\_X**

  X Windows contexts backend, described in  [**selabel\_x**(5)](/selabel_x/5.md).

- **SELABEL\_CTX\_DB**

  Database objects contexts backend, described in [**selabel\_db**(5)](/selabel_db/5.md).

## RETURN VALUE

A non-NULL handle value is returned on success.  On error, NULL is returned and *errno* is set appropriately.

## AUTHOR

Eamon Walsh \<ewalsh@tycho.nsa.gov\>

## SEE ALSO

[**selabel\_lookup**(3)](/selabel_lookup/3.md), [**selabel\_stats**(3)](/selabel_stats/3.md), [**selinux\_set\_callback**(3)](/selinux_set_callback/3.md), [**selinux**(8)](/selinux/8.md)