1avc_has_perm(3)            SELinux API documentation           avc_has_perm(3)
2
3
4

NAME

6       avc_has_perm,  avc_has_perm_noaudit,  avc_audit,  avc_entry_ref_init  -
7       obtain and audit SELinux access decisions.
8

SYNOPSIS

10       #include <selinux/selinux.h>
11
12       #include <selinux/avc.h>
13
14       void avc_entry_ref_init(struct avc_entry_ref *aeref);
15
16       int avc_has_perm(security_id_t ssid, security_id_t tsid,
17                        security_class_t tclass, access_vector_t requested,
18
19                        struct avc_entry_ref *aeref, void *auditdata);
20
21       int avc_has_perm_noaudit(security_id_t ssid, security_id_t tsid,
22                        security_class_t tclass, access_vector_t requested,
23
24                        struct avc_entry_ref *aeref, struct av_decision *avd);
25
26       void avc_audit(security_id_t ssid, security_id_t tsid,
27                      security_class_t tclass, access_vector_t requested,
28
29                      struct av_decision *avd, int result, void *auditdata);
30

DESCRIPTION

32       avc_entry_ref_init initializes an avc_entry_ref  structure;  see  ENTRY
33       REFERENCES below.  This function may be implemented as a macro.
34
35       avc_has_perm  checks  whether the requested permissions are granted for
36       subject SID ssid and target  SID  tsid,  interpreting  the  permissions
37       based  on  tclass  and updating aeref, if non-NULL, to refer to a cache
38       entry with the resulting decision.  The granting or denial  of  permis‐
39       sions  is audited in accordance with the policy.  The auditdata parame‐
40       ter is for supplemental auditing; see avc_audit below.
41
42       avc_has_perm_noaudit behaves as avc_has_perm without producing an audit
43       message.   The  access decision is returned in avd and can be passed to
44       avc_audit explicitly.
45
46       avc_audit produces an audit message for the access query represented by
47       ssid,  tsid, tclass, and requested, with a decision represented by avd.
48       Pass the value returned by avc_has_perm_noaudit as result.  The  audit‐
49       data  parameter  is passed to the user-supplied func_audit callback and
50       can be used to add supplemental information to the audit  message;  see
51       avc_init(3).
52
53

ENTRY REFERENCES

55       Entry  references  can  be used to speed cache performance for repeated
56       queries on the same subject and target.  The userspace AVC  will  check
57       the  aeref  argument, if supplied, before searching the cache on a per‐
58       mission query.  After a query is performed, aeref will  be  updated  to
59       reference  the  cache  entry for that query.  A subsequent query on the
60       same subject and target will then have the  decision  at  hand  without
61       having to walk the cache.
62
63       After  declaring  an avc_entry_ref structure, use avc_entry_ref_init to
64       initialize it before passing it to avc_has_perm or avc_has_perm_noaudit
65       for  the  first  time.   Using  an uninitialized structure will produce
66       undefined behavior.
67
68

RETURN VALUE

70       If requested permissions are granted, zero is returned.   If  requested
71       permissions are denied or an error occured, -1 is returned and errno is
72       set appropriately.
73
74       In permissive mode, zero will be returned and errno unchanged  even  if
75       permissions were denied.  avc_has_perm will still produce an audit mes‐
76       sage in this case.
77
78

ERRORS

80       EACCES A requested permission was denied.
81
82       EINVAL The tclass and/or the security contexts referenced by  ssid  and
83              tsid are not recognized by the currently loaded policy.
84
85       ENOMEM An attempt to allocate memory failed.
86
87

NOTES

89       Internal errors encountered by the userspace AVC may cause certain val‐
90       ues of errno to be returned unexpectedly.  For example, netlink  socket
91       errors  may  produce EACCES or EINVAL.  Make sure that userspace object
92       managers are granted appropriate access to netlink by the policy.
93
94

AUTHOR

96       Eamon Walsh <ewalsh@tycho.nsa.gov>
97
98

SEE ALSO

100       avc_init(3), avc_context_to_sid(3),  avc_cache_stats(3),  avc_add_call‐
101       back(3), security_compute_av(3) selinux(8)
102
103
104
105                                  27 May 2004                  avc_has_perm(3)
Impressum