1avc_open(3)                SELinux API documentation               avc_open(3)
2
3
4

NAME

6       avc_open,  avc_destroy,  avc_reset, avc_cleanup - userspace SELinux AVC
7       setup and teardown
8

SYNOPSIS

10       #include <selinux/selinux.h>
11       #include <selinux/avc.h>
12
13       int avc_open(struct selinux_opt *options, unsigned nopt);
14
15       void avc_destroy(void);
16
17       int avc_reset(void);
18
19       void avc_cleanup(void);
20

DESCRIPTION

22       avc_open() initializes the userspace AVC and must be called before  any
23       other AVC operation can be performed.
24
25       avc_destroy()  destroys  the userspace AVC, freeing all internal memory
26       structures.  After this call has been made, avc_open() must  be  called
27       again before any AVC operations can be performed.
28
29       avc_reset()  flushes the userspace AVC, causing it to forget any cached
30       access decisions.  The userspace AVC normally calls this function auto‐
31       matically when needed, see NETLINK NOTIFICATION below.
32
33       avc_cleanup()  attempts to free unused memory within the userspace AVC,
34       but does not flush any cached access decisions.   Under  normal  opera‐
35       tion, calling this function should not be necessary.
36

OPTIONS

38       The  userspace  AVC obeys callbacks set via selinux_set_callback(3), in
39       particular the logging and audit callbacks.
40
41       The options which may be passed to avc_open() include the following:
42
43       AVC_OPT_SETENFORCE
44              This option forces the userspace AVC into enforcing mode if  the
45              option value is non-NULL; permissive mode otherwise.  The system
46              enforcing mode will be ignored.
47

49       Beginning with version 2.6.4, the Linux kernel supports SELinux  status
50       change  notification  via  netlink.   Two  message  types are currently
51       implemented, indicating changes to the enforcing mode and to the loaded
52       policy  in  the  kernel,  respectively.   The userspace AVC listens for
53       these messages and takes the appropriate action, modifying the behavior
54       of  avc_has_perm(3)  to reflect the current enforcing mode and flushing
55       the cache on receipt of a policy load notification.  Audit messages are
56       produced when netlink notifications are processed.
57

RETURN VALUE

59       Functions  with a return value return zero on success.  On error, -1 is
60       returned and errno is set appropriately.
61

AUTHOR

63       Eamon Walsh <ewalsh@tycho.nsa.gov>
64

SEE ALSO

66       selinux(8), avc_has_perm(3), avc_context_to_sid(3), avc_cache_stats(3),
67       avc_add_callback(3), selinux_set_callback(3), security_compute_av(3)
68
69
70
71                                  12 Jun 2008                      avc_open(3)
Impressum