avc_cache_stats(3) SELinux API documentation avc_cache_stats(3)NAME
avc_cache_stats, avc_av_stats, avc_sid_stats - obtain userspace SELinux AVC statistics
SYNOPSIS
#include <selinux/selinux.h>
#include <selinux/avc.h>
void avc_av_stats(void);
void avc_sid_stats(void);
void avc_cache_stats(struct avc_cache_stats *stats);
DESCRIPTION
The userspace AVC maintains two internal hash tables, one to store security ID's and one to cache access decisions.
avc_av_stats() and avc_sid_stats() produce log messages indicating the status of the access decision and SID tables, respectively. The
messages contain the number of entries in the table, number of hash buckets and number of buckets used, and maximum number of entries in a
single bucket.
avc_cache_stats() populates a structure whose fields reflect cache activity:
struct avc_cache_stats {
unsigned entry_lookups;
unsigned entry_hits;
unsigned entry_misses;
unsigned entry_discards;
unsigned cav_lookups;
unsigned cav_hits;
unsigned cav_probes;
unsigned cav_misses;
};
entry_lookups
Number of queries made.
entry_hits
Number of times a decision was found in the aeref argument.
entry_misses
Number of times a decision was not found in the aeref argument.
entry_discards
Number of times a decision was not found in the aeref argument and the aeref argument was non-NULL.
cav_lookups
Number of cache lookups.
cav_hits
Number of cache hits.
cav_misses
Number of cache misses.
cav_probes
Number of entries examined while searching the cache.
NOTES
When the cache is flushed as a result of a call to avc_reset() or a policy change notification, the statistics returned by
avc_cache_stats() are reset to zero. The SID table, however, is left unchanged.
When a policy change notification is received, a call to avc_av_stats() is made before the cache is flushed.
AUTHOR
Eamon Walsh <ewalsh@tycho.nsa.gov>
SEE ALSO avc_init(3), avc_has_perm(3), avc_context_to_sid(3), avc_add_callback(3), selinux(8)
27 May 2004 avc_cache_stats(3)
Check Out this Related Man Page
avc_has_perm(3) SELinux API documentation avc_has_perm(3)NAME
avc_has_perm, avc_has_perm_noaudit, avc_audit, avc_entry_ref_init - obtain and audit SELinux access decisions
SYNOPSIS
#include <selinux/selinux.h>
#include <selinux/avc.h>
void avc_entry_ref_init(struct avc_entry_ref *aeref);
int avc_has_perm(security_id_t ssid, security_id_t tsid,
security_class_t tclass, access_vector_t requested,
struct avc_entry_ref *aeref, void *auditdata);
int avc_has_perm_noaudit(security_id_t ssid, security_id_t tsid,
security_class_t tclass, access_vector_t requested,
struct avc_entry_ref *aeref, struct av_decision *avd);
void avc_audit(security_id_t ssid, security_id_t tsid,
security_class_t tclass, access_vector_t requested,
struct av_decision *avd, int result, void *auditdata);
DESCRIPTION
avc_entry_ref_init() initializes an avc_entry_ref structure; see ENTRY REFERENCES below. This function may be implemented as a macro.
avc_has_perm() checks whether the requested permissions are granted for subject SID ssid and target SID tsid, interpreting the permissions
based on tclass and updating aeref, if non-NULL, to refer to a cache entry with the resulting decision. The granting or denial of permis-
sions is audited in accordance with the policy. The auditdata parameter is for supplemental auditing; see avc_audit() below.
avc_has_perm_noaudit() behaves as avc_has_perm() without producing an audit message. The access decision is returned in avd and can be
passed to avc_audit() explicitly.
avc_audit() produces an audit message for the access query represented by ssid, tsid, tclass, and requested, with a decision represented by
avd. Pass the value returned by avc_has_perm_noaudit() as result. The auditdata parameter is passed to the user-supplied func_audit call-
back and can be used to add supplemental information to the audit message; see avc_init(3).
ENTRY REFERENCES
Entry references can be used to speed cache performance for repeated queries on the same subject and target. The userspace AVC will check
the aeref argument, if supplied, before searching the cache on a permission query. After a query is performed, aeref will be updated to
reference the cache entry for that query. A subsequent query on the same subject and target will then have the decision at hand without
having to walk the cache.
After declaring an avc_entry_ref structure, use avc_entry_ref_init() to initialize it before passing it to avc_has_perm() or
avc_has_perm_noaudit() for the first time. Using an uninitialized structure will produce undefined behavior.
RETURN VALUE
If requested permissions are granted, zero is returned. If requested permissions are denied or an error occured, -1 is returned and errno
is set appropriately.
In permissive mode, zero will be returned and errno unchanged even if permissions were denied. avc_has_perm() will still produce an audit
message in this case.
ERRORS
EACCES A requested permission was denied.
EINVAL The tclass and/or the security contexts referenced by ssid and tsid are not recognized by the currently loaded policy.
ENOMEM An attempt to allocate memory failed.
NOTES
Internal errors encountered by the userspace AVC may cause certain values of errno to be returned unexpectedly. For example, netlink
socket errors may produce EACCES or EINVAL. Make sure that userspace object managers are granted appropriate access to netlink by the pol-
icy.
AUTHOR
Eamon Walsh <ewalsh@tycho.nsa.gov>
SEE ALSO avc_init(3), avc_context_to_sid(3), avc_cache_stats(3), avc_add_callback(3), security_compute_av(3), selinux(8)
27 May 2004 avc_has_perm(3)