avc_update_node(9)

📦 version 7.3.1, in nixpkgs unstable

✨ avc_update_node(9) ✨

okay so bestie, welcome to avc_update_node — this is a page from the Kernel API Manual (section 9, kernel-dev vibes 💅) and it's literally all about updating an AVC entry. yes. that's the whole thing. and we're gonna get into it 🎀

🌸 NAME 🌸

avc_update_node — Update an AVC entry 🦋

no cap, that's it. short, sweet, iconic.

⭐ SYNOPSIS ⭐

int avc_update_node (u32 event , u32 perms , u8 driver , u8 base_perm ,
       u8 xperm , u32 ssid , u32 tsid , u16 tclass , u32 seqno , struct
       extended_perms_decision *xpd , u32 flags );

eleven arguments. ELEVEN. she's high-maintenance but she's worth it 💖

🫶 ARGUMENTS 🫶

like, so many. let's go through them one by one, bestie, don't skip 👑

  • event — the updating event. the whole reason we're here ✨
  • perms — permission mask bits. mask-y. permission-y. you know how it is.
  • driver — xperm driver information 🚗
  • base_perm — the base permission associated with the extended permission. like the base coat of your nails before the sparkle 💅
  • xperm — xperm permissions 🔥
  • ssid — the AVC entry source sid
  • tsid — the AVC entry target sid
  • tclass — the AVC entry target object class
  • seqno — sequence number from when the decision was made. receipts, basically 🧾
  • xpd — the extended_perms_decision to be added to the node 💖
  • flags — the AVC_* flags, e.g. AVC_EXTENDED_PERMS, or 0. pick your fighter.

🌈 DESCRIPTION 🌈

okay so here's the tea ☕ :

if a valid AVC entry doesn't exist, this function returns -ENOENT. like, she looked and it wasn't there. gone. not found. 😭

if kmalloc called internal returns NULL, this function returns -ENOMEM. the memory said no. we respect the no. 💀

otherwise — and this is the good part ✨ — this function updates the AVC entry. and the original AVC-entry object will release later by RCU. so like, the old one isn't deleted right away, she's just… waiting for her RCU moment. main character exit, lowkey 🌸

no invented extras here, bestie — that's genuinely the whole behavior. three outcomes: -ENOENT, -ENOMEM, or the update. periodt.

🦋 SEE ALSO 🦋

Kernel file ./security/selinux/avc.c

and the whole friend group 👯‍♀️ :

💜 and that's the page!! shoutout to ./security/selinux for hosting her, and this edition is dated October 2026 — so she's from the future, slay 🔮👑 bye bestie, go update some nodes 🎀

📦 where this page comes from