---
name: "selinux_restorecon_xattr"
section: "3"
platform: "linux"
package: "libselinux1-dev"
version: "3.8.1-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/selinux_restorecon_xattr"
---

# selinux\_restorecon\_xattr(3)

manage default security.sehash extended attribute entries added by selinux\_restorecon(3), setfiles(8) or restorecon(8).

## NAME

selinux\_restorecon\_xattr - manage default *security.sehash* extended attribute entries added by [**selinux\_restorecon**(3)](/selinux_restorecon/3.md), [**setfiles**(8)](/setfiles/8.md) or [**restorecon**(8)](/restorecon/8.md).

## SYNOPSIS

**#include \<selinux/restorecon.h\>**

**int selinux\_restorecon\_xattr(const char \****pathname***,**\
 **unsigned int** *xattr\_flags***,**\
 **struct dir\_xattr \*\*\****xattr\_list***);**

## DESCRIPTION

**selinux\_restorecon\_xattr**() returns a linked list of **dir\_xattr** structures containing information described below based on:

*pathname* containing a directory tree to be searched for *security.sehash* extended attribute entries.

*xattr\_flags* contains options as follows:

**SELINUX\_RESTORECON\_XATTR\_RECURSE** recursively descend directories.

**SELINUX\_RESTORECON\_XATTR\_DELETE\_NONMATCH\_DIGESTS** delete non-matching digests from each directory in *pathname*.

**SELINUX\_RESTORECON\_XATTR\_DELETE\_ALL\_DIGESTS** delete all digests from each directory in *pathname*.

**SELINUX\_RESTORECON\_XATTR\_IGNORE\_MOUNTS** do not read **/proc/mounts** to obtain a list of non-seclabel mounts to be excluded from the search.\
 Setting **SELINUX\_RESTORECON\_XATTR\_IGNORE\_MOUNTS** is useful where there is a non-seclabel fs mounted with a seclabel fs mounted on a directory below this.

*xattr\_list* is the returned pointer to a linked list of **dir\_xattr** structures, each containing the following information:

```
struct dir_xattr {
	char *directory;
	char *digest;    /* Printable hex encoded string */
	enum digest_result result;
	struct dir_xattr *next;
};
```

The **result** entry is enumerated as follows:

```
enum digest_result {
	MATCH = 0,
	NOMATCH,
	DELETED_MATCH,
	DELETED_NOMATCH,
	ERROR
};
```

*xattr\_list* must be set to **NULL** before calling [**selinux\_restorecon\_xattr**(3)](/selinux_restorecon_xattr/3.md). The caller is responsible for freeing the returned *xattr\_list* entries in the linked list.

See the **NOTES** section for more information.

## RETURN VALUE

On success, zero is returned.  On error, -1 is returned and *errno* is set appropriately.

## NOTES

- 1\.

  By default [**selinux\_restorecon\_xattr**(3)](/selinux_restorecon_xattr/3.md) will use the default set of specfiles described in **files\_contexts**(5) to calculate the SHA1 digests to be used for comparison. To change this default behavior [**selabel\_open**(3)](/selabel_open/3.md) must be called specifying the required **SELABEL\_OPT\_PATH** and setting the **SELABEL\_OPT\_DIGEST** option to a non-NULL value. [**selinux\_restorecon\_set\_sehandle**(3)](/selinux_restorecon_set_sehandle/3.md) is then called to set the handle to be used by [**selinux\_restorecon\_xattr**(3)](/selinux_restorecon_xattr/3.md).

- 2\.

  By default [**selinux\_restorecon\_xattr**(3)](/selinux_restorecon_xattr/3.md) reads **/proc/mounts** to obtain a list of non-seclabel mounts to be excluded from searches unless the **SELINUX\_RESTORECON\_XATTR\_IGNORE\_MOUNTS** flag has been set.

- 3\.

  **RAMFS** and **TMPFS** filesystems do not support the *security.sehash* extended attribute and are automatically excluded from searches.

- 4\.

  By default **stderr** is used to log output messages and errors. This may be changed by calling [**selinux\_set\_callback**(3)](/selinux_set_callback/3.md) with the **SELINUX\_CB\_LOG** *type* option.

## SEE ALSO

[**selinux\_restorecon**(3)](/selinux_restorecon/3.md)\
 [**selinux\_restorecon\_set\_sehandle**(3)](/selinux_restorecon_set_sehandle/3.md),\
 [**selinux\_restorecon\_default\_handle**(3)](/selinux_restorecon_default_handle/3.md),\
 [**selinux\_restorecon\_set\_exclude\_list**(3)](/selinux_restorecon_set_exclude_list/3.md),\
 [**selinux\_restorecon\_set\_alt\_rootpath**(3)](/selinux_restorecon_set_alt_rootpath/3.md),\
 [**selinux\_set\_callback**(3)](/selinux_set_callback/3.md)