1avc_has_perm(3)            SELinux API documentation           avc_has_perm(3)
2
3
4

NAME

6       avc_has_perm,  avc_has_perm_noaudit,  avc_audit,  avc_entry_ref_init  -
7       obtain and audit SELinux access decisions
8

SYNOPSIS

10       #include <selinux/selinux.h>
11       #include <selinux/avc.h>
12
13       void avc_entry_ref_init(struct avc_entry_ref *aeref);
14
15       int avc_has_perm(security_id_t ssid, security_id_t tsid,
16                        security_class_t tclass, access_vector_t requested,
17                        struct avc_entry_ref *aeref, void *auditdata);
18
19       int avc_has_perm_noaudit(security_id_t ssid, security_id_t tsid,
20                        security_class_t tclass, access_vector_t requested,
21                        struct avc_entry_ref *aeref, struct av_decision *avd);
22
23       void avc_audit(security_id_t ssid, security_id_t tsid,
24                      security_class_t tclass, access_vector_t requested,
25                      struct av_decision *avd, int result, void *auditdata);
26

DESCRIPTION

28       avc_entry_ref_init() initializes an avc_entry_ref structure; see  ENTRY
29       REFERENCES below.  This function may be implemented as a macro.
30
31       avc_has_perm() checks whether the requested permissions are granted for
32       subject SID ssid and target  SID  tsid,  interpreting  the  permissions
33       based  on  tclass  and updating aeref, if non-NULL, to refer to a cache
34       entry with the resulting decision.  The granting or denial  of  permis‐
35       sions  is audited in accordance with the policy.  The auditdata parame‐
36       ter is for supplemental auditing; see avc_audit() below.
37
38       avc_has_perm_noaudit() behaves as avc_has_perm() without  producing  an
39       audit  message.   The  access  decision  is  returned in avd and can be
40       passed to avc_audit() explicitly.
41
42       avc_audit() produces an audit message for the access query  represented
43       by  ssid,  tsid,  tclass, and requested, with a decision represented by
44       avd.  Pass the value returned by avc_has_perm_noaudit() as result.  The
45       auditdata  parameter is passed to the user-supplied func_audit callback
46       and can be used to add supplemental information to the  audit  message;
47       see avc_init(3).
48

ENTRY REFERENCES

50       Entry  references  can  be used to speed cache performance for repeated
51       queries on the same subject and target.  The userspace AVC  will  check
52       the  aeref  argument, if supplied, before searching the cache on a per‐
53       mission query.  After a query is performed, aeref will  be  updated  to
54       reference  the  cache  entry for that query.  A subsequent query on the
55       same subject and target will then have the  decision  at  hand  without
56       having to walk the cache.
57
58       After declaring an avc_entry_ref structure, use avc_entry_ref_init() to
59       initialize   it   before    passing    it    to    avc_has_perm()    or
60       avc_has_perm_noaudit()  for  the  first  time.   Using an uninitialized
61       structure will produce undefined behavior.
62

RETURN VALUE

64       If requested permissions are granted, zero is returned.   If  requested
65       permissions  are  denied or an error occurred, -1 is returned and errno
66       is set appropriately.
67
68       In permissive mode, zero will be returned and errno unchanged  even  if
69       permissions  were  denied.   avc_has_perm() will still produce an audit
70       message in this case.
71

ERRORS

73       EACCES A requested permission was denied.
74
75       EINVAL The tclass and/or the security contexts referenced by  ssid  and
76              tsid are not recognized by the currently loaded policy.
77
78       ENOMEM An attempt to allocate memory failed.
79

NOTES

81       Internal errors encountered by the userspace AVC may cause certain val‐
82       ues of errno to be returned unexpectedly.  For example, netlink  socket
83       errors  may  produce EACCES or EINVAL.  Make sure that userspace object
84       managers are granted appropriate access to netlink by the policy.
85

AUTHOR

87       Eamon Walsh <ewalsh@tycho.nsa.gov>
88

SEE ALSO

90       avc_init(3), avc_context_to_sid(3), avc_cache_stats(3),
91       avc_add_callback(3), security_compute_av(3), selinux(8)
92
93
94
95                                  27 May 2004                  avc_has_perm(3)
Impressum