selabel_lookup(3) library function gives a way to obtain the SELinux security context information for a file - or rather what security label a file is expected to have .
Is there a command line utility which looks up security context information for a file from the policy definitions - possibly one that even uses
selabel_lookup(3) under the covers?
I can sort of use a reverse
grep(1) to search
/etc/selinux/targeted/contexts/files/file_contexts. It looks like entries use extended regular expressions (so
egrep rather than
grep). So I'd have to search the keys in
file_contexts by iterating over them and applying the key to a regex search against my file name. That could get time consuming. For instance, Fedora 23 has 5935 lines in
file_contexts, so that could mean 5935 invocations of grep. I was hoping for a more efficient solution than that.
ls -Z or
secon gives current security context for a file, but that may not be the correct context for that file (as outlined in the SELinux policy definition for the system).