avc_has_perm(3)

💖 avc_has_perm — SELinux API documentation 💖

okay so bestie, welcome to the avc_has_perm(3) page ✨ this is the SELinux access-decision corner of the manual, and we're gonna get you a decision, an audit trail, and a little cache moment. let's go 🫶

---

🌸 NAME 🌸

avc_has_perm, avc_has_perm_noaudit, avc_audit, avc_entry_ref_init — obtain and audit SELinux access decisions 💅

---

✨ SYNOPSIS ✨

#include <selinux/selinux.h>
#include <selinux/avc.h>

void avc_entry_ref_init(struct avc_entry_ref *aeref);

int avc_has_perm(security_id_t ssid, security_id_t tsid,
                 security_class_t tclass, access_vector_t requested,
                 struct avc_entry_ref *aeref, void *auditdata);

int avc_has_perm_noaudit(security_id_t ssid, security_id_t tsid,
                 security_class_t tclass, access_vector_t requested,
                 struct avc_entry_ref *aeref, struct av_decision *avd);

void avc_audit(security_id_t ssid, security_id_t tsid,
               security_class_t tclass, access_vector_t requested,
               struct av_decision *avd, int result, void *auditdata);

---

🦋 DESCRIPTION 🦋

ngl, the vibe check on these functions is: direct use is generally discouraged 🙈 instead, the higher level interface selinux_check_access(3) is the moment, because it automatically handles the dynamic mapping of class and permission names to their policy values and proper handling of allow_unknown. so like, she does the work for you, queen behavior 👑

when you are using any of these functions that take policy integer values for classes or permissions as inputs, use string_to_security_class(3) and string_to_av_perm(3) to map the class and permission names to their policy values. and listen — these values may change across a policy reload 😭 so they should be re-acquired on every use, or by using a SELINUX_CB_POLICYLOAD callback set via selinux_set_callback(3). don't be caught lacking with stale constants fr fr.

an alternative approach is to use selinux_set_mapping(3) to create a mapping from class and permission index values used by the application to the policy values, which lets the application pass its own fixed constants for the classes and permissions to these functions and have them internally mapped on demand ✨ however, this also requires setting up a callback as above to address policy reloads. same energy, same homework 💅

• avc_entry_ref_init() — initializes an avc_entry_ref structure; peep ENTRY REFERENCES below. this function may be implemented as a macro, iykyk.
• avc_has_perm() — checks whether the requested permissions are granted for subject SID ssid and target SID tsid, interpreting the permissions based on tclass, and updating aeref, if non-NULL, to refer to a cache entry with the resulting decision. the granting or denial of permissions is audited in accordance with the policy. the auditdata parameter is for supplemental auditing; see avc_audit() below 🎀
• avc_has_perm_noaudit() — behaves as avc_has_perm() without producing an audit message 🤫 the access decision is returned in avd and can be passed to avc_audit() explicitly.
• avc_audit() — produces an audit message for the access query represented by ssid, tsid, tclass, and requested, with a decision represented by avd. pass the value returned by avc_has_perm_noaudit() as result. the auditdata parameter is passed to the user-supplied func_audit callback and can be used to add supplemental information to the audit message; see avc_init(3) 💜

---

🎀 ENTRY REFERENCES 🎀

entry references can be used to speed cache performance for repeated queries on the same subject and target 🔥 the userspace AVC will check the aeref argument, if supplied, before searching the cache on a permission query. after a query is performed, aeref will be updated to reference the cache entry for that query. a subsequent query on the same subject and target will then have the decision at hand without having to walk the cache. it's giving shortcut, it's giving efficiency, we love her 💅

after declaring an avc_entry_ref structure, use avc_entry_ref_init() to initialize it before passing it to avc_has_perm() or avc_has_perm_noaudit() for the first time.

🚨 bestie. using an uninitialized structure will produce undefined behavior. not a cute look. initialize it. periodt.

---

💫 RETURN VALUE 💫

if requested permissions are granted, zero is returned 🎉 if requested permissions are denied or an error occurred, -1 is returned and errno is set appropriately 😭

in permissive mode, zero will be returned and errno unchanged even if permissions were denied 👀 avc_has_perm() will still produce an audit message in this case.

---

🌈 ERRORS 🌈

• EACCES — a requested permission was denied. rude but fair 💀
• EINVAL — the tclass and/or the security contexts referenced by ssid and tsid are not recognized by the currently loaded policy.
• ENOMEM — an attempt to allocate memory failed.

---

🧚 NOTES 🧚

internal errors encountered by the userspace AVC may cause certain values of errno to be returned unexpectedly 😳 for example, netlink socket errors may produce EACCES or EINVAL. make sure that userspace object managers are granted appropriate access to netlink by the policy. like, set them up properly, bestie, don't leave them hanging 🫶

---

👑 AUTHOR 👑

originally Eamon Walsh. updated by Stephen Smalley <stephen.smalley.work@gmail.com> ✨

---

🍓 SEE ALSO 🍓

selinux_check_access(3), string_to_security_class(3), string_to_av_perm(3), selinux_set_callback(3), selinux_set_mapping(3), avc_init(3), avc_context_to_sid(3), avc_cache_stats(3), avc_add_callback(3), security_compute_av(3), selinux(8)

---

and that's the page, bestie!! this one's dated 27 May 2004, and it comes to you from the SELinux API documentation collection 💖 go forth and get those access decisions, you absolute icon 💅✨🌸