avc_compute_create(3)

💖 avc_compute_create — SELinux API documentation, section 3 💖

okay bestie, sit down, we're learning how to ✨compute SELinux labels✨ for brand new objects, and honestly? it's giving powerful. this page is avc_compute_create(3) and its ride-or-die sibling avc_compute_member(3), straight out of the SELinux API documentation, section 3 of the manual. no cap.

🌸 NAME 🌸

avc_compute_create, avc_compute_member — obtain SELinux label for new object

like literally, that's the whole gig: you want the label for a shiny new object, these two got you 🫶

✨ SYNOPSIS ✨

first, you gotta pull in the headers, both of them:

#include <selinux/selinux.h>
#include <selinux/avc.h>

then, the icons themselves:

int avc_compute_create(security_id_t ssid, security_id_t tsid,
                       security_class_t tclass, security_id_t *newsid);

int avc_compute_member(security_id_t ssid, security_id_t tsid,
                       security_class_t tclass, security_id_t *newsid);

look at those signatures. gorgeous. no notes. 💅

🦋 DESCRIPTION 🦋

so avc_compute_create() is the one you call to compute a SID to use for labeling a new object in a particular class, based on a SID pair. that's it, that's the vibe.

and here's the part that makes it iconic: this call is identical to security_compute_create(), except — and this is the slay — it does not require converting from userspace SID's to contexts and back again. so you skip the whole round-trip glow-up and just get the answer. efficiency queen behavior, fr fr. 👑

then we got avc_compute_member(), which is the polyamorous one (jk jk) — it computes a SID to use for labeling a polyinstantiated object instance of a particular class, based on a SID pair. and yes bestie, same deal: this call is identical to security_compute_member(), but it does not require converting from userspace SID's to contexts and back again. same shortcut, different object flavor. 🌈

and where does the answer land? these functions return a SID for the computed context in the memory referenced by sid. (yes, the parameter is named newsid up top and the description says sid — that's how the page says it, and we do not edit the ancestors. 🙈)

💜 RETURN VALUE 💜

super simple vibe check:

• on success → zero is returned. 0. immaculate. ⭐
• on error → -1 is returned, and errno is set appropriately.

🔥 ERRORS 🔥

the two ways this can go wrong, and we're naming them:

• EINVAL — the tclass and/or the security contexts referenced by ssid and tsid are not recognized by the currently loaded policy. the policy literally does not know her. 💀
• ENOMEM — an attempt to allocate memory failed. the computer said "no ma'am, i'm full." 😭

🎀 AUTHOR 🎀

Eamon Walsh <ewalsh@tycho.nsa.gov>

thank you for your service, king 🫡

🌟 SEE ALSO 🌟

go read these next, bestie, they're all connected:

• avc_init(3)
• avc_context_to_sid(3)
• security_compute_create(3)
• selinux(8)

heads up: these calls are your shortcut past the userspace SID ↔ context conversions, so if you catch yourself converting back and forth, stop. you're doing extra homework for no reason. 💅

that's the whole page, and ngl it ate. this was the avc_compute_create(3) man page from the SELinux API documentation, dated 30 Mar 2007, and the footer would've just said avc_compute_create(3) again like a lil signature. mwah. 💖🦋✨