avc_has_perm_noaudit(3) [centos man page]
avc_has_perm(3) SELinux API documentation avc_has_perm(3) NAME
avc_has_perm, avc_has_perm_noaudit, avc_audit, avc_entry_ref_init - obtain and audit SELinux access decisions SYNOPSIS
#include <selinux/selinux.h> #include <selinux/avc.h> void avc_entry_ref_init(struct avc_entry_ref *aeref); int avc_has_perm(security_id_t ssid, security_id_t tsid, security_class_t tclass, access_vector_t requested, struct avc_entry_ref *aeref, void *auditdata); int avc_has_perm_noaudit(security_id_t ssid, security_id_t tsid, security_class_t tclass, access_vector_t requested, struct avc_entry_ref *aeref, struct av_decision *avd); void avc_audit(security_id_t ssid, security_id_t tsid, security_class_t tclass, access_vector_t requested, struct av_decision *avd, int result, void *auditdata); DESCRIPTION
avc_entry_ref_init() initializes an avc_entry_ref structure; see ENTRY REFERENCES below. This function may be implemented as a macro. avc_has_perm() checks whether the requested permissions are granted for subject SID ssid and target SID tsid, interpreting the permissions based on tclass and updating aeref, if non-NULL, to refer to a cache entry with the resulting decision. The granting or denial of permis- sions is audited in accordance with the policy. The auditdata parameter is for supplemental auditing; see avc_audit() below. avc_has_perm_noaudit() behaves as avc_has_perm() without producing an audit message. The access decision is returned in avd and can be passed to avc_audit() explicitly. avc_audit() produces an audit message for the access query represented by ssid, tsid, tclass, and requested, with a decision represented by avd. Pass the value returned by avc_has_perm_noaudit() as result. The auditdata parameter is passed to the user-supplied func_audit call- back and can be used to add supplemental information to the audit message; see avc_init(3). ENTRY REFERENCES
Entry references can be used to speed cache performance for repeated queries on the same subject and target. The userspace AVC will check the aeref argument, if supplied, before searching the cache on a permission query. After a query is performed, aeref will be updated to reference the cache entry for that query. A subsequent query on the same subject and target will then have the decision at hand without having to walk the cache. After declaring an avc_entry_ref structure, use avc_entry_ref_init() to initialize it before passing it to avc_has_perm() or avc_has_perm_noaudit() for the first time. Using an uninitialized structure will produce undefined behavior. RETURN VALUE
If requested permissions are granted, zero is returned. If requested permissions are denied or an error occured, -1 is returned and errno is set appropriately. In permissive mode, zero will be returned and errno unchanged even if permissions were denied. avc_has_perm() will still produce an audit message in this case. ERRORS
EACCES A requested permission was denied. EINVAL The tclass and/or the security contexts referenced by ssid and tsid are not recognized by the currently loaded policy. ENOMEM An attempt to allocate memory failed. NOTES
Internal errors encountered by the userspace AVC may cause certain values of errno to be returned unexpectedly. For example, netlink socket errors may produce EACCES or EINVAL. Make sure that userspace object managers are granted appropriate access to netlink by the pol- icy. AUTHOR
Eamon Walsh <ewalsh@tycho.nsa.gov> SEE ALSO
avc_init(3), avc_context_to_sid(3), avc_cache_stats(3), avc_add_callback(3), security_compute_av(3), selinux(8) 27 May 2004 avc_has_perm(3)
Check Out this Related Man Page
avc_add_callback(3) SELinux API documentation avc_add_callback(3) NAME
avc_add_callback - additional event notification for SELinux userspace object managers. SYNOPSIS
#include <selinux/selinux.h> #include <selinux/avc.h> int avc_add_callback(int (*callback)(uint32_t event, security_id_t ssid, security_id_t tsid, security_class_t tclass, access_vector_t perms, access_vector_t *out_retained), uint32_t events, security_id_t ssid, security_id_t tsid, security_class_t tclass, access_vector_t perms); DESCRIPTION
avc_add_callback is used to register callback functions on security events. The purpose of this functionality is to allow userspace object managers to take additional action when a policy change, usually a policy reload, causes permissions to be granted or revoked. events is the bitwise-or of security events on which to register the callback; see SECURITY EVENTS below. ssid, tsid, tclass, and perms specify the source and target SID's, target class, and specific permissions that the callback wishes to moni- tor. The special symbol SECSID_WILD may be passed as the source or target and will cause any SID to match. callback is the callback function provided by the userspace object manager. The event argument indicates the security event which occured; the remaining arguments are interpreted according to the event as described below. The return value of the callback should be zero on suc- cess, -1 on error with errno set appropriately (but see RETURN VALUE below). SECURITY EVENTS
In all cases below, ssid and/or tsid may be set to SECSID_WILD, indicating that the change applies to all source and/or target SID's. Unless otherwise indicated, the out_retained parameter is unused. AVC_CALLBACK_GRANT Previously denied permissions are now granted for ssid, tsid with respect to tclass. perms indicates the permissions to grant. AVC_CALLBACK_TRY_REVOKE Previously granted permissions are now conditionally revoked for ssid, tsid with respect to tclass. perms indicates the permissions to revoke. The callback should set out_retained to the subset of perms which are retained as migrated permissions. Note that out_retained is ignored if the callback returns -1. AVC_CALLBACK_REVOKE Previously granted permissions are now unconditionally revoked for ssid, tsid with respect to tclass. perms indicates the permis- sions to revoke. AVC_CALLBACK_RESET Indicates that the cache was flushed. The SID, class, and permission arguments are unused and are set to NULL. AVC_CALLBACK_AUDITALLOW_ENABLE The permissions given by perms should now be audited when granted for ssid, tsid with respect to tclass. AVC_CALLBACK_AUDITALLOW_DISABLE The permissions given by perms should no longer be audited when granted for ssid, tsid with respect to tclass. AVC_CALLBACK_AUDITDENY_ENABLE The permissions given by perms should now be audited when denied for ssid, tsid with respect to tclass. AVC_CALLBACK_AUDITDENY_DISABLE The permissions given by perms should no longer be audited when denied for ssid, tsid with respect to tclass. RETURN VALUE
On success, avc_add_callback returns zero. On error, -1 is returned and errno is set appropriately. A return value of -1 from a callback is interpreted as a failed policy operation. If such a return value is encountered, all remaining callbacks registered on the event are called. In threaded mode, the netlink handler thread may then terminate and cause the userspace AVC to return EINVAL on all further permission checks until avc_destroy(3) is called. In non-threaded mode, the permission check on which the error occurred will return -1 and the value of errno encountered to the caller. In both cases, a log message is produced and the kernel may be notified of the error. ERRORS
ENOMEM An attempt to allocate memory failed. NOTES
If the userspace AVC is running in threaded mode, callbacks registered via avc_add_callback may be executed in the context of the netlink handler thread. This will likely introduce synchronization issues requiring the use of locks. See avc_init(3). Support for dynamic revocation and retained permissions is mostly unimplemented in the SELinux kernel module. The only security event that currently gets excercised is AVC_CALLBACK_RESET. AUTHOR
Eamon Walsh <ewalsh@tycho.nsa.gov> SEE ALSO
avc_init(3), avc_has_perm(3), avc_context_to_sid(3), avc_cache_stats(3), security_compute_av(3) selinux(8) 9 June 2004 avc_add_callback(3)