HTML rendering created 2025-09-06 byMichael Kerrisk, author ofThe Linux Programming Interface. For details of in-depthLinux/UNIX system programming training courses that I teach, lookhere. Hosting byjambit GmbH. |  |
NAME |SYNOPSIS |DESCRIPTION |ENTRY REFERENCES |RETURN VALUE |ERRORS |NOTES |AUTHOR |SEE ALSO |COLOPHON | |
avc_has_perm(3) SELinux API documentationavc_has_perm(3)avc_has_perm, avc_has_perm_noaudit, avc_audit, avc_entry_ref_init - obtain and audit SELinux access decisions
#include <selinux/selinux.h>#include <selinux/avc.h>void avc_entry_ref_init(struct avc_entry_ref *aeref);int avc_has_perm(security_id_tssid, security_id_ttsid,security_class_ttclass, access_vector_trequested,struct avc_entry_ref *aeref, void *auditdata);int avc_has_perm_noaudit(security_id_tssid, security_id_ttsid,security_class_ttclass, access_vector_trequested,struct avc_entry_ref *aeref, struct av_decision*avd);void avc_audit(security_id_tssid, security_id_ttsid,security_class_ttclass, access_vector_trequested,struct av_decision *avd, intresult, void*auditdata);
Direct use of these functions is generally discouraged in favor of the higher level interfaceselinux_check_access(3) since the latter automatically handles the dynamic mapping of class and permission names to their policy values and proper handling of allow_unknown. When using any of the functions that take policy integer values for classes or permissions as inputs, usestring_to_security_class(3) andstring_to_av_perm(3) to map the class and permission names to their policy values. These values may change across a policy reload, so they should be re-acquired on every use or using aSELINUX_CB_POLICYLOADcallback set viaselinux_set_callback(3). An alternative approach is to useselinux_set_mapping(3) to create a mapping from class and permission index values used by the application to the policy values, thereby allowing the application to pass its own fixed constants for the classes and permissions to these functions and internally mapping them on demand. However, this also requires setting up a callback as above to address policy reloads.avc_entry_ref_init() initializes anavc_entry_refstructure; seeENTRY REFERENCESbelow. This function may be implemented as a macro.avc_has_perm() checks whether therequested permissions are granted for subject SIDssid and target SIDtsid, interpreting the permissions based ontclass and updatingaeref, if non-NULL, to refer to a cache entry with the resulting decision. The granting or denial of permissions is audited in accordance with the policy. Theauditdata parameter is for supplemental auditing; seeavc_audit() below.avc_has_perm_noaudit() behaves asavc_has_perm() without producing an audit message. The access decision is returned inavd and can be passed toavc_audit() explicitly.avc_audit() produces an audit message for the access query represented byssid,tsid,tclass, andrequested, with a decision represented byavd. Pass the value returned byavc_has_perm_noaudit() asresult. Theauditdata parameter is passed to the user-suppliedfunc_auditcallback and can be used to add supplemental information to the audit message; seeavc_init(3).
Entry references can be used to speed cache performance for repeated queries on the same subject and target. The userspace AVC will check theaeref argument, if supplied, before searching the cache on a permission query. After a query is performed,aeref will be updated to reference the cache entry for that query. A subsequent query on the same subject and target will then have the decision at hand without having to walk the cache. After declaring anavc_entry_refstructure, useavc_entry_ref_init() to initialize it before passing it toavc_has_perm() oravc_has_perm_noaudit() for the first time. Using an uninitialized structure will produce undefined behavior.
If requested permissions are granted, zero is returned. If requested permissions are denied or an error occurred, -1 is returned anderrno is set appropriately. In permissive mode, zero will be returned anderrno unchanged even if permissions were denied.avc_has_perm() will still produce an audit message in this case.
EACCESA requested permission was denied.EINVALThetclass and/or the security contexts referenced byssid andtsid are not recognized by the currently loaded policy.ENOMEMAn attempt to allocate memory failed.
Internal errors encountered by the userspace AVC may cause certain values oferrno to be returned unexpectedly. For example, netlink socket errors may produceEACCESorEINVAL. Make sure that userspace object managers are granted appropriate access to netlink by the policy.
Originally Eamon Walsh. Updated by Stephen Smalley <stephen.smalley.work@gmail.com>
selinux_check_access(3),string_to_security_class(3),string_to_av_perm(3),selinux_set_callback(3),selinux_set_mapping(3),avc_init(3),avc_context_to_sid(3),avc_cache_stats(3),avc_add_callback(3),security_compute_av(3),selinux(8)
This page is part of theselinux (Security-Enhanced Linux user- space libraries and tools) project. Information about the project can be found at ⟨https://github.com/SELinuxProject/selinux/wiki⟩. If you have a bug report for this manual page, see ⟨https://github.com/SELinuxProject/selinux/wiki/Contributing⟩. This page was obtained from the project's upstream Git repository ⟨https://github.com/SELinuxProject/selinux⟩ on 2025-08-11. (At that time, the date of the most recent commit that was found in the repository was 2025-08-04.) If you discover any rendering problems in this HTML version of the page, or you believe there is a better or more up-to-date source for the page, or you have corrections or improvements to the information in this COLOPHON (which isnot part of the original manual page), send a mail to man-pages@man7.org 27 May 2004avc_has_perm(3)Pages that refer to this page:avc_add_callback(3), avc_cache_stats(3), avc_context_to_sid(3), avc_init(3), avc_netlink_loop(3), avc_open(3), selinux_set_callback(3), selinux_set_mapping(3)
HTML rendering created 2025-09-06 byMichael Kerrisk, author ofThe Linux Programming Interface. For details of in-depthLinux/UNIX system programming training courses that I teach, lookhere. Hosting byjambit GmbH. | |