NAME

       avc_open, avc_destroy, avc_reset, avc_cleanup - userspace SELinux AVC setup and teardown

SYNOPSIS

       #include <selinux/selinux.h>
       #include <selinux/avc.h>

       int avc_open(struct selinux_opt *options, unsigned nopt);

       void avc_destroy(void);

       int avc_reset(void);

       void avc_cleanup(void);

DESCRIPTION

       avc_open() initializes the userspace AVC and must be called before any other AVC operation
       can be performed.

       avc_destroy() destroys the userspace AVC, freeing all internal memory  structures.   After
       this  call has been made, avc_open() must be called again before any AVC operations can be
       performed.

       avc_reset() flushes the userspace AVC, causing it to forget any cached  access  decisions.
       The  userspace  AVC  normally  calls  this function automatically when needed, see NETLINK
       NOTIFICATION below.

       avc_cleanup() attempts to free unused memory within the userspace AVC, but does not  flush
       any  cached access decisions.  Under normal operation, calling this function should not be
       necessary.

OPTIONS

       The userspace AVC obeys callbacks  set  via  selinux_set_callback(3),  in  particular  the
       logging and audit callbacks.

       The options which may be passed to avc_open() include the following:

       AVC_OPT_SETENFORCE
              This  option  forces  the  userspace AVC into enforcing mode if the option value is
              non-NULL; permissive mode otherwise.  The system enforcing mode will be ignored.

NETLINK NOTIFICATION

       Beginning with version 2.6.4, the Linux kernel supports SELinux status change notification
       via  netlink.   Two  message  types  are  currently implemented, indicating changes to the
       enforcing mode and to the loaded policy in the kernel, respectively.   The  userspace  AVC
       listens  for  these  messages  and takes the appropriate action, modifying the behavior of
       avc_has_perm(3) to reflect the current enforcing mode and flushing the cache on receipt of
       a  policy  load  notification.  Audit messages are produced when netlink notifications are
       processed.

RETURN VALUE

       Functions with a return value return zero on success.  On error, -1 is returned and  errno
       is set appropriately.

AUTHOR

       Eamon Walsh <ewalsh@tycho.nsa.gov>

SEE ALSO

       selinux(8),        avc_has_perm(3),       avc_context_to_sid(3),       avc_cache_stats(3),
       avc_add_callback(3), selinux_set_callback(3), security_compute_av(3)

                                           12 Jun 2008                                avc_open(3)