avc_has_perm(9)

💅 avc_has_perm — a.k.a. the Kernel API Manual's avc_has_perm(9) page

okay so bestie, picture this: you're in the SELinux access vector cache (the AVC, iconic behavior) and you need to know if a thing is allowed to do a thing to another thing. That's literally this function. It checks permissions and does the auditing. Both. Multitasking queen. 👑

---

✨ NAME ✨

avc_has_perm — check permissions and perform any appropriate auditing.

Like, it doesn't just peek — it also snitches to the audit log per policy. Periodt.

---

🎀 SYNOPSIS 🎀

int avc_has_perm (u32 ssid , u32 tsid , u16 tclass , u32 requested ,
struct common_audit_data *auditdata );

---

🌸 ARGUMENTS 🌸

• ssid — source security identifier. it's giving "who's asking" 💁
• tsid — target security identifier. the main character being asked about 🎯
• tclass — target security class. the category the target lives in, and it's what decides how requested gets interpreted
• requested — the requested permissions, interpreted based on tclass (yes, tclass is the vibe check here — same bits mean different things depending on it)
• auditdata — auxiliary audit data. the extra receipts 📎

---

🔥 DESCRIPTION 🔥

So here's the tea: it checks the AVC to figure out whether the requested permissions are granted for the SID pair (ssid, tsid), interpreting the permissions based on tclass. And if that's a cache miss? Not me being unprepared — it calls the security server to obtain a new decision and add it to the cache. Lowkey a whole glow-up for the cache every time. ✨

Then it audits the granting or denial of permissions in accordance with the policy. No cap, everything gets logged the way policy says it should. 📝

Return value deets, because you know we care:

• returns 0 if all requested permissions are granted — slay 🎉
• returns -EACCES if any permissions are denied — denied, but make it documented 💀
• or another -errno upon other errors — yeah, other stuff can go wrong too

fr fr though: a denial is not a crash. -EACCES is a normal answer here, so don't be dramatic about it. (Be dramatic about the other -errno values instead. 😭)

---

🦋 SEE ALSO 🦋

Kernel file ./security/selinux/avc.c, plus the whole friend group: avc_init(9), avc_lookup(9), avc_insert(9), avc_audit_pre_callback(9), avc_audit_post_callback(9), avc_add_callback(9), avc_update_node(9), avc_flush(9), avc_ss_reset(9), avc_compute_av(9), avc_perm_nonode(9), avc_has_perm_noaudit(9).

---

and that's the whole page, bestie 💖 brought to you by <./security/selinux> and dated October 2026 — signed off with avc_has_perm(9) energy, mwah 🫶