selinux_set_callback(3)

✨ selinux_set_callback — the SELinux API documentation era ✨

okay bestie, gather round, because we're talking about selinux_set_callback(3) from the SELinux API documentation and it's giving "let me hook up your own little functions into SELinux" energy 💅

🌸 NAME 🌸

selinux_set_callback — userspace SELinux callback facilities 🎀

🦋 SYNOPSIS 🦋

#include <selinux/selinux.h>

void selinux_set_callback(int type, union selinux_callback callback);

💖 DESCRIPTION 💖

so selinux_set_callback() does the thing where it sets the callback that type points at, to the value of callback. and callback? it should be passed as a function pointer cast to type union selinux_callback. slay, we love a union. ✨

lowkey important: all callback functions should return a negative value with errno set appropriately on error. no cap, that's the rule.

the available values for type are, and this is the whole menu bestie, no skips:

• SELINUX_CB_LOG — this one's the logging callback 🗒️

int (*func_log) (int type, const char *fmt, ...);

it's used for logging, and it should process the printf(3) style fmt string and its arguments however makes sense for you. the type argument tells you what kind of message it is, and it'll be set to one of these:

• SELINUX_ERROR
• SELINUX_WARNING
• SELINUX_INFO
• SELINUX_AVC
• SELINUX_POLICYLOAD
• SELINUX_SETENFORCE

SELINUX_ERROR, SELINUX_WARNING, and SELINUX_INFO are your standard log severity levels and, important, they are not auditable messages.

the SELINUX_AVC, SELINUX_POLICYLOAD, and SELINUX_SETENFORCE message types can be audited with the AUDIT_USER_AVC, AUDIT_USER_MAC_POLICY_LOAD, and AUDIT_USER_MAC_STATUS values from libaudit, respectively. and if they are not audited? then SELINUX_AVC should be considered equivalent to SELINUX_ERROR, and similarly SELINUX_POLICYLOAD and SELINUX_SETENFORCE should be considered equivalent to SELINUX_INFO. periodt. 💅

• SELINUX_CB_AUDIT — the supplemental auditing one 🔍

int (*func_audit) (void *auditdata, security_class_t cls,
                   char *msgbuf, size_t msgbufsize);

used for supplemental auditing in AVC messages. the auditdata and cls arguments are literally the values that got passed to avc_has_perm(3). and you should print a human-readable interpretation into msgbuf, using no more than msgbufsize characters. don't overflow bestie, i'm begging 🙈

• SELINUX_CB_VALIDATE — context validation, main character energy 👑

int (*func_validate) (char **ctx);

used for context validation. the callback may optionally modify the input context by setting the target of the ctx pointer to a new context. and if you do that? then the old value should be freed with freecon(3). also you should set errno to EINVAL to indicate an invalid context.

• SELINUX_CB_SETENFORCE — enforcing state change alert 🚨

int (*func_setenforce) (int enforcing);

this one gets invoked whenever the system enforcing state changes. the enforcing argument is the new value, and it's set to 1 for enforcing mode and 0 for permissive mode. so like, 1 = locked in, 0 = vibes only.

• SELINUX_CB_POLICYLOAD — policy reload notification 🌀

int (*func_policyload) (int seqno);

this gets invoked when the system security policy is reloaded. the seqno argument is the current sequential number of the policy generation in the system.

🌈 RETURN VALUE 🌈

None. that's it, that's the whole thing. 💀

🍓 ERRORS 🍓

None. nothing to report, we're chilling. ✨

💜 AUTHOR 💜

Eamon Walsh <ewalsh@tycho.nsa.gov> — ty for your service king 🫶

⭐ SEE ALSO ⭐

• selabel_open(3)
• avc_init(3)
• avc_netlink_open(3)
• selinux(8)

and that's the whole page bestie!! this was 20 Jun 2007 energy from the SELinux API documentation files, and honestly? iconic. go set some callbacks, you got this 🧚💖🌸