avc_has_perm(3) 					     SELinux API documentation						   avc_has_perm(3)

NAME

       avc_has_perm, avc_has_perm_noaudit, avc_audit, avc_entry_ref_init - obtain and audit SELinux access decisions

SYNOPSIS

       #include <selinux/selinux.h>
       #include <selinux/avc.h>

       void avc_entry_ref_init(struct avc_entry_ref *aeref);

       int avc_has_perm(security_id_t ssid, security_id_t tsid,
			security_class_t tclass, access_vector_t requested,
			struct avc_entry_ref *aeref, void *auditdata);

       int avc_has_perm_noaudit(security_id_t ssid, security_id_t tsid,
			security_class_t tclass, access_vector_t requested,
			struct avc_entry_ref *aeref, struct av_decision *avd);

       void avc_audit(security_id_t ssid, security_id_t tsid,
		      security_class_t tclass, access_vector_t requested,
		      struct av_decision *avd, int result, void *auditdata);

DESCRIPTION

       avc_entry_ref_init() initializes an avc_entry_ref structure; see ENTRY REFERENCES below.  This function may be implemented as a macro.

       avc_has_perm()  checks whether the requested permissions are granted for subject SID ssid and target SID tsid, interpreting the permissions
       based on tclass and updating aeref, if non-NULL, to refer to a cache entry with the resulting decision.	The granting or denial of  permis-
       sions is audited in accordance with the policy.	The auditdata parameter is for supplemental auditing; see avc_audit() below.

       avc_has_perm_noaudit()  behaves	as  avc_has_perm()  without producing an audit message.  The access decision is returned in avd and can be
       passed to avc_audit() explicitly.

       avc_audit() produces an audit message for the access query represented by ssid, tsid, tclass, and requested, with a decision represented by
       avd.  Pass the value returned by avc_has_perm_noaudit() as result.  The auditdata parameter is passed to the user-supplied func_audit call-
       back and can be used to add supplemental information to the audit message; see avc_init(3).

ENTRY REFERENCES

       Entry references can be used to speed cache performance for repeated queries on the same subject and target.  The userspace AVC will  check
       the  aeref  argument,  if supplied, before searching the cache on a permission query.  After a query is performed, aeref will be updated to
       reference the cache entry for that query.  A subsequent query on the same subject and target will then have the decision  at  hand  without
       having to walk the cache.

       After  declaring  an  avc_entry_ref  structure,	use  avc_entry_ref_init()  to  initialize  it  before  passing	it  to	avc_has_perm()	or
       avc_has_perm_noaudit() for the first time.  Using an uninitialized structure will produce undefined behavior.

RETURN VALUE

       If requested permissions are granted, zero is returned.	If requested permissions are denied or an error occured, -1 is returned and  errno
       is set appropriately.

       In  permissive mode, zero will be returned and errno unchanged even if permissions were denied.	avc_has_perm() will still produce an audit
       message in this case.

ERRORS

       EACCES A requested permission was denied.

       EINVAL The tclass and/or the security contexts referenced by ssid and tsid are not recognized by the currently loaded policy.

       ENOMEM An attempt to allocate memory failed.

NOTES

       Internal errors encountered by the userspace AVC may cause certain values of errno to  be  returned  unexpectedly.   For  example,  netlink
       socket errors may produce EACCES or EINVAL.  Make sure that userspace object managers are granted appropriate access to netlink by the pol-
       icy.

AUTHOR

       Eamon Walsh <ewalsh@tycho.nsa.gov>

SEE ALSO

       avc_init(3), avc_context_to_sid(3), avc_cache_stats(3), avc_add_callback(3), security_compute_av(3), selinux(8)

								    27 May 2004 						   avc_has_perm(3)