smk_access_entry(9)

💅 smk_access_entry(9) — or, the Kernel API Manual's cutest little lookup function 🎀

okay so bestie, gather round, because this one lives in the Kernel API Manual and it's literally the function that goes "hmm, do you two know each other?" about labels. let's get into it ✨

---

🌸 NAME 🌸

smk_access_entry — look up matching access rule 🔍

---

🦋 SYNOPSIS 🦋

int smk_access_entry (char *subject_label , char *object_label , struct
list_head *rule_list );

like, that's the whole vibe. three args in, an int out. periodt 💅

---

🎀 ARGUMENTS 🎀

• subject_label — a pointer to the subject's Smack label 👑 (yes, the subject, the one doing the doing)
• object_label — a pointer to the object's Smack label 🍓 (the thing being done to, we love a supportive object)
• rule_list — the list of rules to search 📜 like, the actual guest list you're checking

---

✨ DESCRIPTION ✨

so basically? this function looks up the subject/object pair in the access rule list and returns the access mode. that's it, that's the whole job, and she does it flawlessly 💖

and if no entry is found? it returns -ENOENT. 😭 no entry, no vibes, no access.

---

💀 NOTE 💀

okay this part is the lore drop, pay attention bestie:

Earlier versions of this function allowed for labels that were not on the label list. this was done to allow for labels to come over the network that had never been seen before on this host 🌐 like, mystery labels showing up unannounced, no cap.

Unless the receiving socket has the star label, this will always result in a failure check. ⭐ the star labeled socket case is now handled in the networking hooks, so there is no case where the label is not on the label list. glow-up achieved ✨

Checking to see if the address of two labels is the same is now a reliable test. 🔥 fr fr, you can trust it now.

Do the object check first because that is more likely to differ. 👀 iconic optimization advice, honestly.

Allowing write access implies allowing locking. 🔒✍️ write girlies get lock privileges too, that's just how it is.

---

🌈 SEE ALSO 🌈

Kernel file ./security/smack/smack_access.c and the whole friend group:

• smk_access(9)
• smk_tskacc(9)
• smk_curacc(9)
• smack_str_from_perm(9)
• smack_log_callback(9)
• smack_log(9)
• smk_insert_entry(9)
• smk_find_entry(9)
• smk_parse_label_len(9)
• smk_parse_smack(9)
• smk_netlbl_mls(9)
• smack_populate_secattr(9)
• smk_import_entry(9)
• smk_import_valid_label(9)
• smack_from_secid(9)
• smack_privileged_cred(9)
• smack_privileged(9)

---

and that's the page, bestie 🫶 this lil icon comes to you straight from ./security/smack, dated October 2026 — so yeah, she's fresh, she's secure, she's giving main character energy in the Smack subsystem 🧚‍♀️💜 mwah 💋