Re: SElinux integration

[Ivan Gyurdiev <ivg2 cornell edu>]

Ivan Gyurdiev wrote:
> > How do you actually get the context? Does it need more syscalls than the
> > stat that we do by default
> Yes, the context is an extended attribute, we get (or set) it through 
> a call to libselinux, which knows how to exact it.
>
>       #include <selinux/selinux.h>
>
>       int getfilecon(const char *path, security_context_t *con);
>       int lgetfilecon(const char *path, security_context_t *con);
>       int fgetfilecon(int fd, security_context_t *con);
So, to answer your question, libselinux relies on getxattr() and setxattr().