Unix/Linux Go Back    


CentOS 7.0 - man page for avc_has_perm (centos section 3)

Linux & Unix Commands - Search Man Pages
Man Page or Keyword Search:   man
Select Man Page Set:       apropos Keyword Search (sections above)


avc_has_perm(3) 		    SELinux API documentation			  avc_has_perm(3)

NAME
       avc_has_perm,  avc_has_perm_noaudit,  avc_audit,  avc_entry_ref_init  -	obtain	and audit
       SELinux access decisions

SYNOPSIS
       #include <selinux/selinux.h>
       #include <selinux/avc.h>

       void avc_entry_ref_init(struct avc_entry_ref *aeref);

       int avc_has_perm(security_id_t ssid, security_id_t tsid,
			security_class_t tclass, access_vector_t requested,
			struct avc_entry_ref *aeref, void *auditdata);

       int avc_has_perm_noaudit(security_id_t ssid, security_id_t tsid,
			security_class_t tclass, access_vector_t requested,
			struct avc_entry_ref *aeref, struct av_decision *avd);

       void avc_audit(security_id_t ssid, security_id_t tsid,
		      security_class_t tclass, access_vector_t requested,
		      struct av_decision *avd, int result, void *auditdata);

DESCRIPTION
       avc_entry_ref_init() initializes an avc_entry_ref structure; see ENTRY  REFERENCES  below.
       This function may be implemented as a macro.

       avc_has_perm()  checks  whether the requested permissions are granted for subject SID ssid
       and target SID tsid, interpreting the permissions based on tclass and updating  aeref,  if
       non-NULL,  to  refer to a cache entry with the resulting decision.  The granting or denial
       of permissions is audited in accordance with the policy.  The auditdata parameter  is  for
       supplemental auditing; see avc_audit() below.

       avc_has_perm_noaudit()  behaves as avc_has_perm() without producing an audit message.  The
       access decision is returned in avd and can be passed to avc_audit() explicitly.

       avc_audit() produces an audit message for the access  query  represented  by  ssid,  tsid,
       tclass,	and  requested,  with  a decision represented by avd.  Pass the value returned by
       avc_has_perm_noaudit() as result.  The auditdata parameter is passed to the  user-supplied
       func_audit  callback and can be used to add supplemental information to the audit message;
       see avc_init(3).

ENTRY REFERENCES
       Entry references can be used to speed cache performance for repeated queries on	the  same
       subject	and target.  The userspace AVC will check the aeref argument, if supplied, before
       searching the cache on a permission query.  After a query  is  performed,  aeref  will  be
       updated	to reference the cache entry for that query.  A subsequent query on the same sub-
       ject and target will then have the decision at hand without having to walk the cache.

       After declaring an avc_entry_ref structure,  use  avc_entry_ref_init()  to  initialize  it
       before  passing	it to avc_has_perm() or avc_has_perm_noaudit() for the first time.  Using
       an uninitialized structure will produce undefined behavior.

RETURN VALUE
       If requested permissions are granted, zero is  returned.   If  requested  permissions  are
       denied or an error occured, -1 is returned and errno is set appropriately.

       In  permissive  mode,  zero  will be returned and errno unchanged even if permissions were
       denied.	avc_has_perm() will still produce an audit message in this case.

ERRORS
       EACCES A requested permission was denied.

       EINVAL The tclass and/or the security contexts referenced by ssid and tsid are not  recog-
	      nized by the currently loaded policy.

       ENOMEM An attempt to allocate memory failed.

NOTES
       Internal  errors  encountered by the userspace AVC may cause certain values of errno to be
       returned unexpectedly.  For example, netlink socket errors may produce EACCES  or  EINVAL.
       Make  sure that userspace object managers are granted appropriate access to netlink by the
       policy.

AUTHOR
       Eamon Walsh <ewalsh@tycho.nsa.gov>

SEE ALSO
       avc_init(3), avc_context_to_sid(3), avc_cache_stats(3), avc_add_callback(3),
       security_compute_av(3), selinux(8)

					   27 May 2004				  avc_has_perm(3)
Unix & Linux Commands & Man Pages : ©2000 - 2018 Unix and Linux Forums


All times are GMT -4. The time now is 01:06 AM.