---
name: "selabel_lookup_best_match"
section: "3"
platform: "linux"
package: "libselinux1-dev"
version: "3.8.1-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/selabel_lookup_best_match"
---

# selabel\_lookup\_best\_match(3)

obtain a best match SELinux security context - Only supported on file backend.

## NAME

selabel\_lookup\_best\_match - obtain a best match SELinux security context - Only supported on file backend.

## SYNOPSIS

**#include \<selinux/selinux.h\>**\
 **#include \<selinux/label.h\>**

**int selabel\_lookup\_best\_match(struct selabel\_handle \****hnd***,** **char \*\****context***,**\
 **const char \****key***,**\
 **const char \*\****links***,**\
 **int** *type***);**

**int selabel\_lookup\_best\_match\_raw(struct selabel\_handle \****hnd***,** **char \*\****context***,**\
 **const char \****key***,**\
 **const char \*\****links***,**\
 **int** *type***);**

## DESCRIPTION

**selabel\_lookup\_best\_match**() performs a best match lookup operation on the handle *hnd*, returning the result in the memory pointed to by *context*, which must be freed by the caller using [**freecon**(3)](/freecon/3.md). The *key* parameter is a file path to check for best match using zero or more *link* (aliases) parameters. The order of precedence for best match is:

- 1\.

  An exact match for the real path (*key*) or

- 2\.

  An exact match for any of the *link*s (aliases), or

- 3\.

  The longest fixed prefix match.

The *type* parameter is an optional file *mode* argument that should be set to the mode bits of the file, as determined by [**lstat**(2)](/lstat/2.md). *mode* may be zero, however full matching may not occur.

**selabel\_lookup\_best\_match\_raw**() behaves identically to **selabel\_lookup\_best\_match**() but does not perform context translation.

## RETURN VALUE

On success, zero is returned.  On error, -1 is returned and *errno* is set appropriately.

## ERRORS

- **ENOENT**

  No context corresponding to the input *key* and *type* was found.

- **EINVAL**

  The *key* and/or *type* inputs are invalid, or the context being returned failed validation, or a regular expression in the database failed to compile.

- **ENOMEM**

  An attempt to allocate memory failed.

## NOTES

Example usage - When a service creates a device node, it may also create one or more symlinks to the device node.  These symlinks may be the only stable name for the device, e.g. if the partition is dynamically assigned. The file label backend supports this by looking up the "best match" for a device node based on its real path (*key*) and any *link*s to it (aliases). The order of precedence for best match is described above.

## SEE ALSO

[**selabel\_open**(3)](/selabel_open/3.md), [**selabel\_stats**(3)](/selabel_stats/3.md), [**selinux\_set\_callback**(3)](/selinux_set_callback/3.md), [**selinux**(8)](/selinux/8.md), [**lstat**(2)](/lstat/2.md), [**selabel\_file**(5)](/selabel_file/5.md)