NAME

       avc_has_perm,  avc_has_perm_noaudit,  avc_audit,  avc_entry_ref_init  -  obtain  and audit SELinux access
       decisions

SYNOPSIS

       #include <selinux/selinux.h>
       #include <selinux/avc.h>

       void avc_entry_ref_init(struct avc_entry_ref *aeref);

       int avc_has_perm(security_id_t ssid, security_id_t tsid,
                        security_class_t tclass, access_vector_t requested,
                        struct avc_entry_ref *aeref, void *auditdata);

       int avc_has_perm_noaudit(security_id_t ssid, security_id_t tsid,
                        security_class_t tclass, access_vector_t requested,
                        struct avc_entry_ref *aeref, struct av_decision *avd);

       void avc_audit(security_id_t ssid, security_id_t tsid,
                      security_class_t tclass, access_vector_t requested,
                      struct av_decision *avd, int result, void *auditdata);

DESCRIPTION

       Direct use of  these  functions  is  generally  discouraged  in  favor  of  the  higher  level  interface
       selinux_check_access(3)  since  the  latter  automatically  handles  the  dynamic  mapping  of  class and
       permission names to their policy values and proper handling of allow_unknown.

       When using any of the functions that take policy integer values for classes or permissions as inputs, use
       string_to_security_class(3)  and  string_to_av_perm(3)  to  map  the  class and permission names to their
       policy values.  These values may change across a policy reload, so they should be  re-acquired  on  every
       use or using a SELINUX_CB_POLICYLOAD callback set via selinux_set_callback(3).

       An  alternative  approach  is to use selinux_set_mapping(3) to create a mapping from class and permission
       index values used by the application to the policy values, thereby allowing the application to  pass  its
       own  fixed  constants  for  the classes and permissions to these functions and internally mapping them on
       demand.  However, this also requires setting up a callback as above to address policy reloads.

       avc_entry_ref_init() initializes an avc_entry_ref structure; see ENTRY REFERENCES below.   This  function
       may be implemented as a macro.

       avc_has_perm()  checks  whether the requested permissions are granted for subject SID ssid and target SID
       tsid, interpreting the permissions based on tclass and updating aeref, if non-NULL, to refer to  a  cache
       entry  with  the resulting decision.  The granting or denial of permissions is audited in accordance with
       the policy.  The auditdata parameter is for supplemental auditing; see avc_audit() below.

       avc_has_perm_noaudit() behaves as avc_has_perm() without producing an audit message.  The access decision
       is returned in avd and can be passed to avc_audit() explicitly.

       avc_audit()  produces  an  audit  message  for  the  access  query represented by ssid, tsid, tclass, and
       requested, with a decision represented by avd.  Pass the  value  returned  by  avc_has_perm_noaudit()  as
       result.   The  auditdata  parameter is passed to the user-supplied func_audit callback and can be used to
       add supplemental information to the audit message; see avc_init(3).

ENTRY REFERENCES

       Entry references can be used to speed cache performance for repeated queries  on  the  same  subject  and
       target.   The  userspace  AVC will check the aeref argument, if supplied, before searching the cache on a
       permission query.  After a query is performed, aeref will be updated to reference  the  cache  entry  for
       that  query.   A  subsequent  query  on  the  same subject and target will then have the decision at hand
       without having to walk the cache.

       After declaring an avc_entry_ref structure, use avc_entry_ref_init() to initialize it before  passing  it
       to  avc_has_perm()  or  avc_has_perm_noaudit() for the first time.  Using an uninitialized structure will
       produce undefined behavior.

RETURN VALUE

       If requested permissions are granted, zero is returned.  If requested permissions are denied or an  error
       occurred, -1 is returned and errno is set appropriately.

       In  permissive  mode,  zero  will  be  returned  and  errno  unchanged  even  if permissions were denied.
       avc_has_perm() will still produce an audit message in this case.

ERRORS

       EACCES A requested permission was denied.

       EINVAL The tclass and/or the security contexts referenced by ssid and tsid  are  not  recognized  by  the
              currently loaded policy.

       ENOMEM An attempt to allocate memory failed.

NOTES

       Internal  errors  encountered  by  the  userspace  AVC  may  cause certain values of errno to be returned
       unexpectedly.  For example, netlink socket errors may produce EACCES or EINVAL.  Make sure that userspace
       object managers are granted appropriate access to netlink by the policy.

AUTHOR

       Originally Eamon Walsh.  Updated by Stephen Smalley <sds@tycho.nsa.gov>

SEE ALSO

       selinux_check_access(3), string_to_security_class(3), string_to_av_perm(3), selinux_set_callback(3),
       selinux_set_mapping(3), avc_init(3), avc_context_to_sid(3), avc_cache_stats(3), avc_add_callback(3),
       security_compute_av(3), selinux(8)

                                                   27 May 2004                                   avc_has_perm(3)