Provided by: libselinux1-dev_2.1.0-4.1ubuntu1_amd64 bug

NAME

       avc_open, avc_destroy, avc_reset, avc_cleanup - userspace SELinux AVC setup and teardown.

SYNOPSIS

       #include <selinux/selinux.h>

       #include <selinux/avc.h>

       int avc_open(struct selinux_opt *options, unsigned nopt);

       void avc_destroy(void);

       int avc_reset(void);

       void avc_cleanup(void);

DESCRIPTION

       avc_open  initializes  the userspace AVC and must be called before any other AVC operation
       can be performed.

       avc_destroy destroys the userspace AVC, freeing all  internal  memory  structures.   After
       this  call  has  been made, avc_open must be called again before any AVC operations can be
       performed.

       avc_reset flushes the userspace AVC, causing it to forget  any  cached  access  decisions.
       The  userspace  AVC  normally  calls  this function automatically when needed, see NETLINK
       NOTIFICATION below.

       avc_cleanup attempts to free unused memory within the userspace AVC, but  does  not  flush
       any  cached access decisions.  Under normal operation, calling this function should not be
       necessary.

OPTIONS

       The userspace AVC obeys callbacks  set  via  selinux_set_callback(3),  in  particular  the
       logging and audit callbacks.

       The options which may be passed to avc_open include the following:

       AVC_OPT_SETENFORCE
              This  option  forces  the  userspace AVC into enforcing mode if the option value is
              non-NULL; permissive mode otherwise.  The system enforcing mode will be ignored.

NETLINK NOTIFICATION

       Beginning with version 2.6.4, the Linux kernel supports SELinux status change notification
       via  netlink.   Two  message  types  are  currently implemented, indicating changes to the
       enforcing mode and to the loaded policy in the kernel, respectively.   The  userspace  AVC
       listens  for  these  messages  and takes the appropriate action, modifying the behavior of
       avc_has_perm(3) to reflect the current enforcing mode and flushing the cache on receipt of
       a  policy  load  notification.  Audit messages are produced when netlink notifications are
       processed.

RETURN VALUE

       Functions with a return value return zero on success.  On error, -1 is returned and  errno
       is set appropriately.

AUTHOR

       Eamon Walsh <ewalsh@tycho.nsa.gov>

SEE ALSO

       selinux(8),        avc_has_perm(3),       avc_context_to_sid(3),       avc_cache_stats(3),
       avc_add_callback(3), selinux_set_callback(3), security_compute_av(3)

                                           12 Jun 2008                                avc_open(3)