NAME

       selinux_set_callback - userspace SELinux callback facilities

SYNOPSIS

       #include <selinux/selinux.h>

       void selinux_set_callback(int type, union selinux_callback callback);

DESCRIPTION

       selinux_set_callback()  sets  the  callback  indicated  by type to the value of callback, which should be
       passed as a function pointer cast to type union selinux_callback.

       All callback functions should return a negative value with errno set appropriately on error.

       The available values for type are:

       SELINUX_CB_LOG
              int (*func_log) (int type, const char *fmt, ...);

              This callback is used for logging and should process the printf(3) style fmt string and  arguments
              as  appropriate.   The  type  argument indicates the type of message and will be set to one of the
              following:

              SELINUX_ERROR

              SELINUX_WARNING

              SELINUX_INFO

              SELINUX_AVC

              SELINUX_POLICYLOAD

              SELINUX_SETENFORCE

              SELINUX_ERROR, SELINUX_WARNING, and SELINUX_INFO indicate standard log severity levels and are not
              auditable messages.

              The  SELINUX_AVC,  SELINUX_POLICYLOAD,  and  SELINUX_SETENFORCE  message types can be audited with
              AUDIT_USER_AVC,  AUDIT_USER_MAC_POLICY_LOAD,  and  AUDIT_USER_MAC_STATUS  values  from   libaudit,
              respectively.    If  they  are  not  audited,  SELINUX_AVC  should  be  considered  equivalent  to
              SELINUX_ERROR;  similarly,  SELINUX_POLICYLOAD  and  SELINUX_SETENFORCE   should   be   considered
              equivalent to SELINUX_INFO.

       SELINUX_CB_AUDIT
              int (*func_audit) (void *auditdata, security_class_t cls,
                                 char *msgbuf, size_t msgbufsize);

              This  callback is used for supplemental auditing in AVC messages.  The auditdata and cls arguments
              are the values passed to avc_has_perm(3).  A human-readable interpretation should  be  printed  to
              msgbuf using no more than msgbufsize characters.

       SELINUX_CB_VALIDATE
              int (*func_validate) (char **ctx);

              This  callback  is  used  for  context  validation.   The callback may optionally modify the input
              context by setting the target of the ctx pointer to a new context.  In this case,  the  old  value
              should  be  freed  with  freecon(3).   The  value  of errno should be set to EINVAL to indicate an
              invalid context.

       SELINUX_CB_SETENFORCE
              int (*func_setenforce) (int enforcing);

              This callback is invoked  when  the  system  enforcing  state  changes.   The  enforcing  argument
              indicates the new value and is set to 1 for enforcing mode, and 0 for permissive mode.

       SELINUX_CB_POLICYLOAD
              int (*func_policyload) (int seqno);

              This  callback  is invoked when the system security policy is reloaded.  The seqno argument is the
              current sequential number of the policy generation in the system.

RETURN VALUE

       None.

ERRORS

       None.

AUTHOR

       Eamon Walsh <ewalsh@tycho.nsa.gov>

SEE ALSO

       selabel_open(3), avc_init(3), avc_netlink_open(3), selinux(8)

                                                   20 Jun 2007                           selinux_set_callback(3)