avc_has_perm_noaudit(9)

📦 version 7.3.1, in nixpkgs unstable

✨ avc_has_perm_noaudit(9) ✨

okay so bestie, welcome to avc_has_perm_noaudit from the Kernel API Manual — yes it's a section 9 page, yes it's kernel-time, and yes it's lowkey iconic 🎀

💖 NAME 💖

avc_has_perm_noaudit — check permissions but perform no auditing. like, she checks the vibes and says yes or no, but she does NOT write it in the group chat. no receipts, no paper trail, we move in silence 🤫

🌸 SYNOPSIS 🌸

int avc_has_perm_noaudit (u32 ssid , u32 tsid , u16 tclass , u32
requested , unsigned int flags , struct av_decision *avd );

that's the whole signature, don't @ me, it's giving six-argument main character energy 👑

🦋 ARGUMENTS 🦋

  • ssid — source security identifier. the "who's asking" SID, the origin story 💫
  • tsid — target security identifier. the "who are they asking about" SID, the other half of the ship 🫶
  • tclass — target security class. this is the category the permissions get read through, so like, context is everything bestie
  • requested — the requested permissions, interpreted based on tclass. yes literally, the meaning depends on tclass, so don't come at it sideways
  • flags — AVC_STRICT or 0. two choices, that's the whole menu 💅
  • avd — access vector decisions. the output spot where the decisions get copied 💌

🔥 DESCRIPTION 🔥

so the whole thing is: check the AVC to determine whether the requested permissions are granted for the SID pair (ssid, tsid), interpreting the permissions based on tclass, and call the security server on a cache miss to obtain a new decision and add it to the cache. periodt 💀

then she returns a copy of the decisions in avd. cute, right? 🎀

the return values are:

  • 0 if all requested permissions are granted — slay, we love a yes
  • -EACCES if any permissions are denied — not slay, but at least she told you
  • another -errno upon other errors — it's giving "something else went wrong, check the errno bestie"
fr fr, this function is typically called by avc_has_perm, but may also be called directly to separate permission checking from auditing, e.g. in cases where a lock must be held for the check but should be released for the auditing. that's the whole reason she exists — the lock-holding part and the auditing part have different vibes and you gotta keep 'em apart 😭🔒

💜 SEE ALSO 💜

kernel file ./security/selinux/avc.c — go read the source, iykyk 📖✨ and also these icons:

and that's the page bestie, no cap, every flag accounted for, go check some perms 🧚💖

okay bye ily, this one's brought to you by ./security/selinux, October 2026 edition — and yes, avc_has_perm_noaudit(9) is literally the title, we came full circle 🌈⭐

📦 where this page comes from