avc_has_perm(3) — Linux manual page


avc_has_perm(3)           SELinux API documentation          avc_has_perm(3)

NAME         top

       avc_has_perm,  avc_has_perm_noaudit,  avc_audit, avc_entry_ref_init -
       obtain and audit SELinux access decisions

SYNOPSIS         top

       #include <selinux/selinux.h>
       #include <selinux/avc.h>

       void avc_entry_ref_init(struct avc_entry_ref *aeref);

       int avc_has_perm(security_id_t ssid, security_id_t tsid,
                        security_class_t tclass, access_vector_t requested,
                        struct avc_entry_ref *aeref, void *auditdata);

       int avc_has_perm_noaudit(security_id_t ssid, security_id_t tsid,
                        security_class_t tclass, access_vector_t requested,
                        struct avc_entry_ref *aeref, struct av_decision

       void avc_audit(security_id_t ssid, security_id_t tsid,
                      security_class_t tclass, access_vector_t requested,
                      struct av_decision *avd, int result, void *auditdata);

DESCRIPTION         top

       Direct use of these functions is generally discouraged in favor of
       the higher level interface selinux_check_access(3) since the latter
       automatically handles the dynamic mapping of class and permission
       names to their policy values and proper handling of allow_unknown.

       When using any of the functions that take policy integer values for
       classes or permissions as inputs, use string_to_security_class(3) and
       string_to_av_perm(3) to map the class and permission names to their
       policy values.  These values may change across a policy reload, so
       they should be re-acquired on every use or using a
       SELINUX_CB_POLICYLOAD callback set via selinux_set_callback(3).

       An alternative approach is to use selinux_set_mapping(3) to create a
       mapping from class and permission index values used by the
       application to the policy values, thereby allowing the application to
       pass its own fixed constants for the classes and permissions to these
       functions and internally mapping them on demand.  However, this also
       requires setting up a callback as above to address policy reloads.

       avc_entry_ref_init() initializes an avc_entry_ref structure; see
       ENTRY REFERENCES below.  This function may be implemented as a macro.

       avc_has_perm() checks whether the requested permissions are granted
       for subject SID ssid and target SID tsid, interpreting the
       permissions based on tclass and updating aeref, if non-NULL, to refer
       to a cache entry with the resulting decision.  The granting or denial
       of permissions is audited in accordance with the policy.  The
       auditdata parameter is for supplemental auditing; see avc_audit()

       avc_has_perm_noaudit() behaves as avc_has_perm() without producing an
       audit message.  The access decision is returned in avd and can be
       passed to avc_audit() explicitly.

       avc_audit() produces an audit message for the access query
       represented by ssid, tsid, tclass, and requested, with a decision
       represented by avd.  Pass the value returned by
       avc_has_perm_noaudit() as result.  The auditdata parameter is passed
       to the user-supplied func_audit callback and can be used to add
       supplemental information to the audit message; see avc_init(3).


       Entry references can be used to speed cache performance for repeated
       queries on the same subject and target.  The userspace AVC will check
       the aeref argument, if supplied, before searching the cache on a
       permission query.  After a query is performed, aeref will be updated
       to reference the cache entry for that query.  A subsequent query on
       the same subject and target will then have the decision at hand
       without having to walk the cache.

       After declaring an avc_entry_ref structure, use avc_entry_ref_init()
       to initialize it before passing it to avc_has_perm() or
       avc_has_perm_noaudit() for the first time.  Using an uninitialized
       structure will produce undefined behavior.

RETURN VALUE         top

       If requested permissions are granted, zero is returned.  If requested
       permissions are denied or an error occurred, -1 is returned and errno
       is set appropriately.

       In permissive mode, zero will be returned and errno unchanged even if
       permissions were denied.  avc_has_perm() will still produce an audit
       message in this case.

ERRORS         top

       EACCES A requested permission was denied.

       EINVAL The tclass and/or the security contexts referenced by ssid and
              tsid are not recognized by the currently loaded policy.

       ENOMEM An attempt to allocate memory failed.

NOTES         top

       Internal errors encountered by the userspace AVC may cause certain
       values of errno to be returned unexpectedly.  For example, netlink
       socket errors may produce EACCES or EINVAL.  Make sure that userspace
       object managers are granted appropriate access to netlink by the

AUTHOR         top

       Originally Eamon Walsh.  Updated by Stephen Smalley

SEE ALSO         top

       selinux_check_access(3), string_to_security_class(3),
       string_to_av_perm(3), selinux_set_callback(3),
       selinux_set_mapping(3), avc_init(3), avc_context_to_sid(3),
       avc_cache_stats(3), avc_add_callback(3), security_compute_av(3),

COLOPHON         top

       This page is part of the selinux (Security-Enhanced Linux user-space
       libraries and tools) project.  Information about the project can be
       found at ⟨https://github.com/SELinuxProject/selinux/wiki⟩.  If you
       have a bug report for this manual page, see
       ⟨https://github.com/SELinuxProject/selinux/wiki/Contributing⟩.  This
       page was obtained from the project's upstream Git repository
       ⟨https://github.com/SELinuxProject/selinux⟩ on 2020-11-01.  (At that
       time, the date of the most recent commit that was found in the repos‐
       itory was 2020-10-31.)  If you discover any rendering problems in
       this HTML version of the page, or you believe there is a better or
       more up-to-date source for the page, or you have corrections or im‐
       provements to the information in this COLOPHON (which is not part of
       the original manual page), send a mail to man-pages@man7.org

                                 27 May 2004                 avc_has_perm(3)

Pages that refer to this page: avc_add_callback(3)avc_av_stats(3)avc_cache_stats(3)avc_cleanup(3)avc_context_to_sid(3)avc_destroy(3)avc_get_initial_context(3)avc_get_initial_sid(3)avc_init(3)avc_netlink_acquire_fd(3)avc_netlink_check_nb(3)avc_netlink_close(3)avc_netlink_loop(3)avc_netlink_open(3)avc_netlink_release_fd(3)avc_open(3)avc_reset(3)avc_sid_stats(3)avc_sid_to_context(3)selinux_set_callback(3)selinux_set_mapping(3)sidget(3)sidput(3)