Linux and UNIX Man Pages

Linux & Unix Commands - Search Man Pages

security_setenforce(3) [centos man page]

security_getenforce(3)					     SELinux API documentation					    security_getenforce(3)

security_getenforce, security_setenforce, security_deny_unknown - get or set the enforcing state of SELinux SYNOPSIS
#include <selinux/selinux.h> int security_getenforce(void); int security_setenforce(int value); int security_deny_unknown(void); DESCRIPTION
security_getenforce() returns 0 if SELinux is running in permissive mode, 1 if it is running in enforcing mode, and -1 on error. security_setenforce() sets SELinux to enforcing mode if the value 1 is passed in, and sets it to permissive mode if 0 is passed in. On success 0 is returned, on error -1 is returned. security_deny_unknown() returns 0 if SELinux treats policy queries on undefined object classes or permissions as being allowed, 1 if such queries are denied, and -1 on error. SEE ALSO
selinux(8) 1 January 2004 security_getenforce(3)

Check Out this Related Man Page

selinux_status_open(3)					     SELinux API documentation					    selinux_status_open(3)

selinux_status_open, selinux_status_close, selinux_status_updated, selinux_status_getenforce, selinux_status_policyload and selinux_sta- tus_deny_unknown - reference the SELinux kernel status without invocation of system calls. SYNOPSIS
#include <selinux/avc.h> int selinux_status_open(int fallback,); void selinux_status_close(void); int selinux_status_updated(void); int selinux_status_getenforce(void); int selinux_status_policyload(void); int selinux_status_deny_unknown(void); DESCRIPTION
Linux 2.6.37 or later provides a SELinux kernel status page; being mostly placed on /selinux/status entry. It enables userspace applica- tions to mmap this page with read-only mode, then it informs some status without system call invocations. In some cases that a userspace application tries to apply heavy frequest access control; such as row-level security in databases, it will face unignorable cost to communicate with kernel space to check invalidation of userspace avc. These functions provides applications a way to know some kernel events without system-call invocation or worker thread for monitoring. selinux_status_open tries to open(2) /selinux/status and mmap(2) it in read-only mode. The file-descriptor and pointer to the page shall be stored internally; Don't touch them directly. Set 1 on the fallback argument to handle a case of older kernels without kernel status page support. In this case, this function tries to open a netlink socket using avc_netlink_open(3) and overwrite corresponding callbacks ( setenforce and policyload). Thus, we need to pay attention to the interaction with these interfaces, when fallback mode is enabled. selinux_status_close unmap the kernel status page and close its file descriptor, or close the netlink socket if fallbacked. selinux_status_updated informs us whether something has been updated since the last call. It returns 0 if nothing was happened, however, 1 if something has been updated in this duration, or -1 on error. selinux_status_getenforce returns 0 if SELinux is running in permissive mode, 1 if enforcing mode, or -1 on error. Same as security_geten- force(3) except with or without system call invocation. selinux_status_policyload returns times of policy reloaded on the running system, or -1 on error. Note that it is not a reliable value on fallback-mode until it receive the first event message via netlink socket. Thus, don't use this value to know actual times of policy reloaded. selinux_status_deny_unknown returns 0 if SELinux treats policy queries on undefined object classes or permissions as being allowed, 1 if such queries are denied, or -1 on error. Also note that these interfaces are not thread-safe, so you have to protect them from concurrent calls using exclusive locks when multiple threads are performing. RETURN VALUE
selinux_status_open returns 0 or 1 on success. 1 means we are ready to use these interfaces, but netlink socket was opened as fallback instead of the kernel status page. On error, -1 shall be returned. Any other functions with a return value shall return its characteristic value as described above, or -1 on errors. SEE ALSO
mmap(2) avc_netlink_open(3) security_getenforce(3) security_deny_unknown(3) 22 January 2011 selinux_status_open(3)
Man Page