Man Pages

avc_has_perm(3) - phpMan avc_has_perm(3) - phpMan

Command: man perldoc info search(apropos)  


avc_has_perm(3)            SELinux API documentation           avc_has_perm(3)



NAME
       avc_has_perm,  avc_has_perm_noaudit, avc_audit, avc_entry_ref_init - obtain and audit SELinux access decisions.

SYNOPSIS
       #include <selinux/selinux.h>

       #include <selinux/avc.h>

       void avc_entry_ref_init(struct avc_entry_ref *aeref);

       int avc_has_perm(security_id_t ssid, security_id_t tsid,
                        security_class_t tclass, access_vector_t requested,

                        struct avc_entry_ref *aeref, void *auditdata);

       int avc_has_perm_noaudit(security_id_t ssid, security_id_t tsid,
                        security_class_t tclass, access_vector_t requested,

                        struct avc_entry_ref *aeref, struct av_decision *avd);

       void avc_audit(security_id_t ssid, security_id_t tsid,
                      security_class_t tclass, access_vector_t requested,

                      struct av_decision *avd, int result, void *auditdata);

DESCRIPTION
       avc_entry_ref_init initializes an avc_entry_ref structure; see ENTRY REFERENCES below.  This  function  may  be
       implemented as a macro.

       avc_has_perm  checks  whether  the  requested permissions are granted for subject SID ssid and target SID tsid,
       interpreting the permissions based on tclass and updating aeref, if non-NULL, to refer to a  cache  entry  with
       the  resulting  decision.  The granting or denial of permissions is audited in accordance with the policy.  The
       auditdata parameter is for supplemental auditing; see avc_audit below.

       avc_has_perm_noaudit behaves as avc_has_perm without producing  an  audit  message.   The  access  decision  is
       returned in avd and can be passed to avc_audit explicitly.

       avc_audit produces an audit message for the access query represented by ssid, tsid, tclass, and requested, with
       a decision represented by avd.  Pass the value returned  by  avc_has_perm_noaudit  as  result.   The  auditdata
       parameter is passed to the user-supplied func_audit callback and can be used to add supplemental information to
       the audit message; see avc_init(3).


ENTRY REFERENCES
       Entry references can be used to speed cache performance for repeated queries on the same  subject  and  target.
       The userspace AVC will check the aeref argument, if supplied, before searching the cache on a permission query.
       After a query is performed, aeref will be updated to reference the cache entry for that  query.   A  subsequent
       query on the same subject and target will then have the decision at hand without having to walk the cache.

       After  declaring  an  avc_entry_ref  structure,  use  avc_entry_ref_init  to initialize it before passing it to
       avc_has_perm or avc_has_perm_noaudit for the first time.  Using an uninitialized structure will  produce  unde-
       fined behavior.


RETURN VALUE
       If  requested  permissions  are  granted,  zero  is  returned.  If requested permissions are denied or an error
       occured, -1 is returned and errno is set appropriately.

       In permissive mode, zero will be returned and errno unchanged even if permissions  were  denied.   avc_has_perm
       will still produce an audit message in this case.


ERRORS
       EACCES A requested permission was denied.

       EINVAL The  tclass and/or the security contexts referenced by ssid and tsid are not recognized by the currently
              loaded policy.

       ENOMEM An attempt to allocate memory failed.


NOTES
       Internal errors encountered by the userspace AVC may cause certain values of errno to be returned unexpectedly.
       For  example, netlink socket errors may produce EACCES or EINVAL.  Make sure that userspace object managers are
       granted appropriate access to netlink by the policy.


AUTHOR
       Eamon Walsh <ewalshATtycho.gov>


SEE ALSO
       avc_init(3), avc_context_to_sid(3), avc_cache_stats(3), avc_add_callback(3), security_compute_av(3) selinux(8)



                                  27 May 2004                  avc_has_perm(3)