.\" Hey Emacs! This file is -*- nroff -*- source.

.\"

.\" Author: Eamon Walsh (ewalsh@epoch.ncsc.mil) 2004

.TH "avc_has_perm" "3" "27 May 2004" "" "SE Linux API documentation"

.SH "NAME"

avc_has_perm, avc_has_perm_noaudit, avc_audit, avc_entry_ref_init \- obtain and audit SELinux access decisions.

.SH "SYNOPSIS"

.B #include <selinux/selinux.h>

.br

.B #include <selinux/avc.h>

.sp

.BI "void avc_entry_ref_init(struct avc_entry_ref *" aeref ");"

.sp

.BI "int avc_has_perm(security_id_t " ssid ", security_id_t " tsid ,

.in +\w'int avc_has_perm('u

.BI "security_class_t " tclass ", access_vector_t " requested ,

.br

.BI "struct avc_entry_ref *" aeref ", void *" auditdata ");"

.in

.sp

.BI "int avc_has_perm_noaudit(security_id_t " ssid ", security_id_t " tsid ,

.in +\w'int avc_has_perm('u

.BI "security_class_t " tclass ", access_vector_t " requested ,

.br

.BI "struct avc_entry_ref *" aeref ", struct av_decision *" avd ");"

.in

.sp

.BI "void avc_audit(security_id_t " ssid ", security_id_t " tsid ,

.in +\w'void avc_audit('u

.BI "security_class_t " tclass ", access_vector_t " requested ,

.br

.BI "struct av_decision *" avd ", int " result ", void *" auditdata ");"

.in

.SH "DESCRIPTION"

.B avc_entry_ref_init

initializes an

.B avc_entry_ref

structure; see

.B ENTRY REFERENCES

below.  This function may be implemented as a macro.

.B avc_has_perm

checks whether the 

.I requested

permissions are granted

for subject SID

.IR ssid

and target SID

.IR tsid ,

interpreting the permissions

based on

.I tclass

and updating

.IR aeref ,

if non-NULL, to refer to a cache entry with the resulting decision.  The granting or denial of permissions is audited in accordance with the policy.  The

.I auditdata

parameter is for supplemental auditing; see

.B avc_audit

below.

.B avc_has_perm_noaudit

behaves as

.B avc_has_perm

without producing an audit message.  The access decision is returned in

.I avd

and can be passed to

.B avc_audit

explicitly.

.B avc_audit

produces an audit message for the access query represented by

.IR ssid ,

.IR tsid ,

.IR tclass ,

and

.IR requested ,

with a decision represented by

.IR avd .

Pass the value returned by

.B avc_has_perm_noaudit

as

.IR result .

The

.I auditdata

parameter is passed to the user-supplied

.B func_audit

callback and can be used to add supplemental information to the audit message; see

.BR avc_init (3).

.SH "ENTRY REFERENCES"

Entry references can be used to speed cache performance for repeated queries on the same subject and target.  The userspace AVC will check the

.I aeref

argument, if supplied, before searching the cache on a permission query.  After a query is performed,

.I aeref

will be updated to reference the cache entry for that query.  A subsequent query on the same subject and target will then have the decision at hand without having to walk the cache.

After declaring an

.B avc_entry_ref

structure, use

.B avc_entry_ref_init

to initialize it before passing it to

.B avc_has_perm

or

.B avc_has_perm_noaudit

for the first time.

Using an uninitialized structure will produce undefined behavior.

.SH "RETURN VALUE"

If requested permissions are granted, zero is returned.  If requested permissions are denied or an error occured, \-1 is returned and

.I errno

is set appropriately.

In permissive mode, zero will be returned and

.I errno

unchanged even if permissions were denied.

.B avc_has_perm

will still produce an audit message in this case.

.SH "ERRORS"

.TP

.B EACCES

A requested permission was denied.

.TP

.B EINVAL

The

.I tclass

and/or the security contexts referenced by

.I ssid

and

.I tsid

are not recognized by the currently loaded policy.

.TP

.B ENOMEM

An attempt to allocate memory failed.

.SH "NOTES"

Internal errors encountered by the userspace AVC may cause certain values of

.I errno

to be returned unexpectedly.  For example, netlink socket errors may produce

.B EACCES

or

.BR EINVAL .

Make sure that userspace object managers are granted appropriate access to

netlink by the policy.

.SH "AUTHOR"

Eamon Walsh <ewalsh@epoch.ncsc.mil>

.SH "SEE ALSO"

.BR avc_init (3),

.BR avc_context_to_sid (3),

.BR avc_cache_stats (3),

.BR avc_add_callback (3),

.BR security_compute_av (3)