|
NAME | SYNOPSIS | DESCRIPTION | ENTRY REFERENCES | RETURN VALUE | ERRORS | NOTES | AUTHOR | SEE ALSO | COLOPHON |
avc_has_perm(3) SELinux API documentation avc_has_perm(3)
avc_has_perm, avc_has_perm_noaudit, avc_audit, avc_entry_ref_init -
obtain and audit SELinux access decisions
#include <selinux/selinux.h>
#include <selinux/avc.h>
void avc_entry_ref_init(struct avc_entry_ref *aeref);
int avc_has_perm(security_id_t ssid, security_id_t tsid,
security_class_t tclass, access_vector_t requested,
struct avc_entry_ref *aeref, void *auditdata);
int avc_has_perm_noaudit(security_id_t ssid, security_id_t tsid,
security_class_t tclass, access_vector_t requested,
struct avc_entry_ref *aeref, struct av_decision
*avd);
void avc_audit(security_id_t ssid, security_id_t tsid,
security_class_t tclass, access_vector_t requested,
struct av_decision *avd, int result, void *auditdata);
avc_entry_ref_init() initializes an avc_entry_ref structure; see
ENTRY REFERENCES below. This function may be implemented as a macro.
avc_has_perm() checks whether the requested permissions are granted
for subject SID ssid and target SID tsid, interpreting the
permissions based on tclass and updating aeref, if non-NULL, to refer
to a cache entry with the resulting decision. The granting or denial
of permissions is audited in accordance with the policy. The
auditdata parameter is for supplemental auditing; see avc_audit()
below.
avc_has_perm_noaudit() behaves as avc_has_perm() without producing an
audit message. The access decision is returned in avd and can be
passed to avc_audit() explicitly.
avc_audit() produces an audit message for the access query
represented by ssid, tsid, tclass, and requested, with a decision
represented by avd. Pass the value returned by
avc_has_perm_noaudit() as result. The auditdata parameter is passed
to the user-supplied func_audit callback and can be used to add
supplemental information to the audit message; see avc_init(3).
Entry references can be used to speed cache performance for repeated
queries on the same subject and target. The userspace AVC will check
the aeref argument, if supplied, before searching the cache on a
permission query. After a query is performed, aeref will be updated
to reference the cache entry for that query. A subsequent query on
the same subject and target will then have the decision at hand
without having to walk the cache.
After declaring an avc_entry_ref structure, use avc_entry_ref_init()
to initialize it before passing it to avc_has_perm() or
avc_has_perm_noaudit() for the first time. Using an uninitialized
structure will produce undefined behavior.
If requested permissions are granted, zero is returned. If requested
permissions are denied or an error occurred, -1 is returned and errno
is set appropriately.
In permissive mode, zero will be returned and errno unchanged even if
permissions were denied. avc_has_perm() will still produce an audit
message in this case.
EACCES A requested permission was denied.
EINVAL The tclass and/or the security contexts referenced by ssid and
tsid are not recognized by the currently loaded policy.
ENOMEM An attempt to allocate memory failed.
Internal errors encountered by the userspace AVC may cause certain
values of errno to be returned unexpectedly. For example, netlink
socket errors may produce EACCES or EINVAL. Make sure that userspace
object managers are granted appropriate access to netlink by the
policy.
Eamon Walsh <ewalsh@tycho.nsa.gov>
avc_init(3), avc_context_to_sid(3), avc_cache_stats(3),
avc_add_callback(3), security_compute_av(3), selinux(8)
This page is part of the selinux (Security-Enhanced Linux user-space
libraries and tools) project. Information about the project can be
found at ⟨https://github.com/SELinuxProject/selinux/wiki⟩. If you
have a bug report for this manual page, see
⟨https://github.com/SELinuxProject/selinux/wiki/Contributing⟩. This
page was obtained from the project's upstream Git repository
⟨https://github.com/SELinuxProject/selinux⟩ on 2017-07-05. If you
discover any rendering problems in this HTML version of the page, or
you believe there is a better or more up-to-date source for the page,
or you have corrections or improvements to the information in this
COLOPHON (which is not part of the original manual page), send a mail
to man-pages@man7.org
27 May 2004 avc_has_perm(3)
Pages that refer to this page: avc_add_callback(3), avc_cache_stats(3), avc_context_to_sid(3), avc_init(3), avc_netlink_loop(3), avc_open(3), selinux_set_callback(3)