1avc_has_perm(3) SELinux API documentation avc_has_perm(3)
2
6 avc_has_perm, avc_has_perm_noaudit, avc_audit, avc_entry_ref_init -
7 obtain and audit SELinux access decisions.
8
10 #include <selinux/selinux.h>
11 #include <selinux/avc.h>
13 void avc_entry_ref_init(struct avc_entry_ref *aeref);
15 int avc_has_perm(security_id_t ssid, security_id_t tsid,
17 security_class_t tclass, access_vector_t requested,
18 struct avc_entry_ref *aeref, void *auditdata);
20 int avc_has_perm_noaudit(security_id_t ssid, security_id_t tsid,
22 security_class_t tclass, access_vector_t requested,
23 struct avc_entry_ref *aeref, struct av_decision *avd);
25 void avc_audit(security_id_t ssid, security_id_t tsid,
27 security_class_t tclass, access_vector_t requested,
28 struct av_decision *avd, int result, void *auditdata);
30
32 avc_entry_ref_init initializes an avc_entry_ref structure; see ENTRY
33 REFERENCES below. This function may be implemented as a macro.
34 avc_has_perm checks whether the requested permissions are granted for
36 subject SID ssid and target SID tsid, interpreting the permissions
37 based on tclass and updating aeref, if non-NULL, to refer to a cache
38 entry with the resulting decision. The granting or denial of permis‐
39 sions is audited in accordance with the policy. The auditdata parame‐
40 ter is for supplemental auditing; see avc_audit below.
41 avc_has_perm_noaudit behaves as avc_has_perm without producing an audit
43 message. The access decision is returned in avd and can be passed to
44 avc_audit explicitly.
45 avc_audit produces an audit message for the access query represented by
47 ssid, tsid, tclass, and requested, with a decision represented by avd.
48 Pass the value returned by avc_has_perm_noaudit as result. The audit‐
49 data parameter is passed to the user-supplied func_audit callback and
50 can be used to add supplemental information to the audit message; see
51 avc_init(3).
52
55 Entry references can be used to speed cache performance for repeated
56 queries on the same subject and target. The userspace AVC will check
57 the aeref argument, if supplied, before searching the cache on a per‐
58 mission query. After a query is performed, aeref will be updated to
59 reference the cache entry for that query. A subsequent query on the
60 same subject and target will then have the decision at hand without
61 having to walk the cache.
62 After declaring an avc_entry_ref structure, use avc_entry_ref_init to
64 initialize it before passing it to avc_has_perm or avc_has_perm_noaudit
65 for the first time. Using an uninitialized structure will produce
66 undefined behavior.
67
70 If requested permissions are granted, zero is returned. If requested
71 permissions are denied or an error occured, -1 is returned and errno is
72 set appropriately.
73 In permissive mode, zero will be returned and errno unchanged even if
75 permissions were denied. avc_has_perm will still produce an audit mes‐
76 sage in this case.
77
80 EACCES A requested permission was denied.
81 EINVAL The tclass and/or the security contexts referenced by ssid and
83 tsid are not recognized by the currently loaded policy.
84 ENOMEM An attempt to allocate memory failed.
86
89 Internal errors encountered by the userspace AVC may cause certain val‐
90 ues of errno to be returned unexpectedly. For example, netlink socket
91 errors may produce EACCES or EINVAL. Make sure that userspace object
92 managers are granted appropriate access to netlink by the policy.
93
96 Eamon Walsh <ewalsh@tycho.nsa.gov>
97
100 avc_init(3), avc_context_to_sid(3), avc_cache_stats(3), avc_add_call‐
101 back(3), security_compute_av(3) selinux(8)
102 27 May 2004 avc_has_perm(3)