NAME

       security_getenforce,       security_setenforce,      security_deny_unknown,      security_reject_unknown,
       security_get_checkreqprot - get or set the enforcing state of SELinux

SYNOPSIS

       #include <selinux/selinux.h>

       int security_getenforce(void);

       int security_setenforce(int value);

       int security_deny_unknown(void);

       int security_reject_unknown(void);

       int security_get_checkreqprot(void);

DESCRIPTION

       security_getenforce() returns 0 if SELinux is running in permissive mode, 1 if it is running in enforcing
       mode, and -1 on error.

       security_setenforce()  sets  SELinux  to  enforcing  mode  if  the  value  1 is passed in, and sets it to
       permissive mode if 0 is passed in.  On success 0 is returned, on error -1 is returned.

       security_deny_unknown() returns 0 if SELinux  treats  policy  queries  on  undefined  object  classes  or
       permissions as being allowed, 1 if such queries are denied, and -1 on error.

       security_reject_unknown()  returns  1  if  the  current  policy  was built with handle-unknown=reject and
       SELinux would reject loading it, if it did not define all kernel object classes and permissions. In  this
       state,  when  selinux_set_mapping() and selinux_check_access() are used with an undefined userspace class
       or permission, an error is returned and errno is set to EINVAL.

       It returns 0 if the current policy was built with handle-unknown=allow or  handle-unknown=deny.  In  this
       state, policy queries are treated according to security_deny_unknown().  -1 is returned on error.

       security_get_checkreqprot()  can  be  used  to  determine  whether  SELinux  is  configured  to check the
       protection requested by the application or the actual protection that  will  be  applied  by  the  kernel
       (including  the effects of READ_IMPLIES_EXEC) on mmap and mprotect calls.  It returns 0 if SELinux checks
       the actual protection, 1 if it checks the requested protection, and -1 on error.

SEE ALSO

       selinux(8)