Man Linux: Main Page and Category List

NAME

       avc_has_perm,  avc_has_perm_noaudit,  avc_audit,  avc_entry_ref_init  -
       obtain and audit SELinux access decisions.

SYNOPSIS

       #include <selinux/selinux.h>

       #include <selinux/avc.h>

       void avc_entry_ref_init(struct avc_entry_ref *aeref);

       int avc_has_perm(security_id_t ssid, security_id_t tsid,
                        security_class_t tclass, access_vector_t requested,

                        struct avc_entry_ref *aeref, void *auditdata);

       int avc_has_perm_noaudit(security_id_t ssid, security_id_t tsid,
                        security_class_t tclass, access_vector_t requested,

                        struct avc_entry_ref *aeref, struct av_decision *avd);

       void avc_audit(security_id_t ssid, security_id_t tsid,
                      security_class_t tclass, access_vector_t requested,

                      struct av_decision *avd, int result, void *auditdata);

DESCRIPTION

       avc_entry_ref_init  initializes  an  avc_entry_ref structure; see ENTRY
       REFERENCES below.  This function may be implemented as a macro.

       avc_has_perm checks whether the requested permissions are  granted  for
       subject  SID  ssid  and  target  SID tsid, interpreting the permissions
       based on tclass and updating aeref, if non-NULL, to refer  to  a  cache
       entry   with  the  resulting  decision.   The  granting  or  denial  of
       permissions is audited in accordance with the  policy.   The  auditdata
       parameter is for supplemental auditing; see avc_audit below.

       avc_has_perm_noaudit behaves as avc_has_perm without producing an audit
       message.  The access decision is returned in avd and can be  passed  to
       avc_audit explicitly.

       avc_audit produces an audit message for the access query represented by
       ssid, tsid, tclass, and requested, with a decision represented by  avd.
       Pass  the  value  returned  by  avc_has_perm_noaudit  as  result.   The
       auditdata parameter is passed to the user-supplied func_audit  callback
       and  can  be used to add supplemental information to the audit message;
       see avc_init(3).

ENTRY REFERENCES

       Entry references can be used to speed cache  performance  for  repeated
       queries  on  the same subject and target.  The userspace AVC will check
       the aeref argument, if  supplied,  before  searching  the  cache  on  a
       permission query.  After a query is performed, aeref will be updated to
       reference the cache entry for that query.  A subsequent  query  on  the
       same  subject  and  target  will then have the decision at hand without
       having to walk the cache.

       After declaring an avc_entry_ref structure, use  avc_entry_ref_init  to
       initialize it before passing it to avc_has_perm or avc_has_perm_noaudit
       for the first time.  Using  an  uninitialized  structure  will  produce
       undefined behavior.

RETURN VALUE

       If  requested  permissions are granted, zero is returned.  If requested
       permissions are denied or an error occured, -1 is returned and errno is
       set appropriately.

       In  permissive  mode, zero will be returned and errno unchanged even if
       permissions were denied.  avc_has_perm  will  still  produce  an  audit
       message in this case.

ERRORS

       EACCES A requested permission was denied.

       EINVAL The  tclass  and/or the security contexts referenced by ssid and
              tsid are not recognized by the currently loaded policy.

       ENOMEM An attempt to allocate memory failed.

NOTES

       Internal errors encountered by the  userspace  AVC  may  cause  certain
       values  of  errno  to  be  returned unexpectedly.  For example, netlink
       socket errors may produce EACCES or EINVAL.  Make sure  that  userspace
       object  managers  are  granted  appropriate  access  to  netlink by the
       policy.

AUTHOR

       Eamon Walsh <ewalsh@tycho.nsa.gov>

SEE ALSO

       avc_init(3),         avc_context_to_sid(3),         avc_cache_stats(3),
       avc_add_callback(3), security_compute_av(3) selinux(8)

                                  27 May 2004                  avc_has_perm(3)