selinux_set_mapping(3)

1selinux_set_mapping(3)     SELinux API documentation    selinux_set_mapping(3)
2
3
4

NAME

6       selinux_set_mapping  -  establish  dynamic  object class and permission
7       mapping
8

SYNOPSIS

10       #include <selinux/selinux.h>
11
12       struct security_class_mapping {
13            const char *name;
14            const char *perms[];
15       };
16
17       int selinux_set_mapping(struct security_class_mapping *map);
18

DESCRIPTION

20       selinux_set_mapping() establishes a mapping from a user-provided order‐
21       ing  of  object classes and permissions to the numbers actually used by
22       the loaded system policy. If using this function,  applications  should
23       also  set  a SELINUX_CB_POLICYLOAD callback via selinux_set_callback(3)
24       that calls this function again upon a policy reload  to  re-create  the
25       mapping  in  case the class or permission values change in the new pol‐
26       icy.  Generally it is preferred to instead use  selinux_check_access(3)
27       instead  of  avc_has_perm(3) or security_compute_av(3) and not use this
28       function at all.
29
30       After the mapping is established, all libselinux functions that operate
31       on  class  and  permission values take the user-provided numbers, which
32       are determined as follows:
33
34       The map argument consists of an array of security_class_mapping  struc‐
35       tures,  which  must  be  terminated  by  a structure having a NULL name
36       field.  Except for this last structure, the name field should refer  to
37       the  string  name of an object class, and the corresponding perms field
38       should refer to an array of permission bit names terminated by  a  NULL
39       string.
40
41       The object classes named in the mapping and the bit indexes of each set
42       of permission bits named in the mapping are numbered in order  starting
43       from  1.   These numbers are the values that should be passed to subse‐
44       quent libselinux calls.
45

RETURN VALUE

47       Zero is returned on success.  On error, -1 is returned and errno is set
48       appropriately.
49

ERRORS

51       EINVAL One of the class or permission names requested in the mapping is
52              not present in the loaded policy.
53
54       ENOMEM An attempt to allocate memory failed.
55

EXAMPLE

57              struct security_class_mapping map[] = {
58                  { "file", { "create", "unlink", "read", "write", NULL } },
59                  { "socket", { "bind", NULL } },
60                  { "process", { "signal", NULL } },
61                  { NULL }
62              };
63
64              if (selinux_set_mapping(map) < 0)
65                  exit(1);
66
67       In this example, after the call has succeeded,  classes  file,  socket,
68       and  process  will  be identified by 1, 2 and 3, respectively.  Permis‐
69       sions create, unlink, read, and write (for  the  file  class)  will  be
70       identified by 1, 2, 4, and 8 respectively.  Classes and permissions not
71       listed in the mapping cannot be used.
72

AUTHOR

74       Originally Eamon Walsh.  Updated by Stephen Smalley <sds@tycho.nsa.gov>
75