RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2024-12-12 17:15:00 +00:00
Code Issues Packages Projects Releases Wiki Activity
21fb5f20da
selinux/libselinux/man/man3/avc_open.3

100 lines
3.2 KiB
Groff
Raw Normal View History

initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.\" Hey Emacs! This file is -*- nroff -*- source.
.\"
.\" Author: Eamon Walsh (ewalsh@tycho.nsa.gov) 2008
.TH "avc_open" "3" "12 Jun 2008" "" "SELinux API documentation"
.SH "NAME"
libselinux: man: Fix man pages formatting - Add man page sections '(N)' to external references, and '()' on functions described in the same man page. - Escape minus signs when those are expected to be used on the command line or files. - Mark files and variables in italic; Note headings, function names, constants, program options and man page references in bold. - Do not justify and hyphenate SEE ALSO section, and avoid hyphenation on symbol names by prepending them with \%. - Remove trailing dot from NAME section description. - Split sections with a no-op command '.', to visually distinguish them but to avoid introducing spurious vertical space in the formatted output. - Add explicit .sp commands in the SYNOPSIS section between function prototypes, and fix space placement in function protoypes. - Split header includes with .br (instead of the explicit or implicit .sp) so that they are vertically contiguous. - Add missing {} around SELINUXTYPE and POLICYTYPE variable text in paths. - Remove unneeded formatting commands. - Remove spurious blank lines. Signed-off-by: Guillem Jover <guillem@debian.org> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-11-13 20:15:34 +00:00
avc_open, avc_destroy, avc_reset, avc_cleanup \- userspace SELinux AVC setup and teardown
.
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.SH "SYNOPSIS"
.B #include <selinux/selinux.h>
libselinux: man: Fix man pages formatting - Add man page sections '(N)' to external references, and '()' on functions described in the same man page. - Escape minus signs when those are expected to be used on the command line or files. - Mark files and variables in italic; Note headings, function names, constants, program options and man page references in bold. - Do not justify and hyphenate SEE ALSO section, and avoid hyphenation on symbol names by prepending them with \%. - Remove trailing dot from NAME section description. - Split sections with a no-op command '.', to visually distinguish them but to avoid introducing spurious vertical space in the formatted output. - Add explicit .sp commands in the SYNOPSIS section between function prototypes, and fix space placement in function protoypes. - Split header includes with .br (instead of the explicit or implicit .sp) so that they are vertically contiguous. - Add missing {} around SELINUXTYPE and POLICYTYPE variable text in paths. - Remove unneeded formatting commands. - Remove spurious blank lines. Signed-off-by: Guillem Jover <guillem@debian.org> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-11-13 20:15:34 +00:00
.br
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.B #include <selinux/avc.h>
.sp
.BI "int avc_open(struct selinux_opt *" options ", unsigned " nopt ");"
.sp
.BI "void avc_destroy(void);"
.sp
.BI "int avc_reset(void);"
.sp
.BI "void avc_cleanup(void);"
libselinux: man: Fix man pages formatting - Add man page sections '(N)' to external references, and '()' on functions described in the same man page. - Escape minus signs when those are expected to be used on the command line or files. - Mark files and variables in italic; Note headings, function names, constants, program options and man page references in bold. - Do not justify and hyphenate SEE ALSO section, and avoid hyphenation on symbol names by prepending them with \%. - Remove trailing dot from NAME section description. - Split sections with a no-op command '.', to visually distinguish them but to avoid introducing spurious vertical space in the formatted output. - Add explicit .sp commands in the SYNOPSIS section between function prototypes, and fix space placement in function protoypes. - Split header includes with .br (instead of the explicit or implicit .sp) so that they are vertically contiguous. - Add missing {} around SELINUXTYPE and POLICYTYPE variable text in paths. - Remove unneeded formatting commands. - Remove spurious blank lines. Signed-off-by: Guillem Jover <guillem@debian.org> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-11-13 20:15:34 +00:00
.
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.SH "DESCRIPTION"
libselinux: man: Fix man pages formatting - Add man page sections '(N)' to external references, and '()' on functions described in the same man page. - Escape minus signs when those are expected to be used on the command line or files. - Mark files and variables in italic; Note headings, function names, constants, program options and man page references in bold. - Do not justify and hyphenate SEE ALSO section, and avoid hyphenation on symbol names by prepending them with \%. - Remove trailing dot from NAME section description. - Split sections with a no-op command '.', to visually distinguish them but to avoid introducing spurious vertical space in the formatted output. - Add explicit .sp commands in the SYNOPSIS section between function prototypes, and fix space placement in function protoypes. - Split header includes with .br (instead of the explicit or implicit .sp) so that they are vertically contiguous. - Add missing {} around SELINUXTYPE and POLICYTYPE variable text in paths. - Remove unneeded formatting commands. - Remove spurious blank lines. Signed-off-by: Guillem Jover <guillem@debian.org> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-11-13 20:15:34 +00:00
.BR avc_open ()
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
initializes the userspace AVC and must be called before any other AVC operation can be performed.
libselinux: man: Fix man pages formatting - Add man page sections '(N)' to external references, and '()' on functions described in the same man page. - Escape minus signs when those are expected to be used on the command line or files. - Mark files and variables in italic; Note headings, function names, constants, program options and man page references in bold. - Do not justify and hyphenate SEE ALSO section, and avoid hyphenation on symbol names by prepending them with \%. - Remove trailing dot from NAME section description. - Split sections with a no-op command '.', to visually distinguish them but to avoid introducing spurious vertical space in the formatted output. - Add explicit .sp commands in the SYNOPSIS section between function prototypes, and fix space placement in function protoypes. - Split header includes with .br (instead of the explicit or implicit .sp) so that they are vertically contiguous. - Add missing {} around SELINUXTYPE and POLICYTYPE variable text in paths. - Remove unneeded formatting commands. - Remove spurious blank lines. Signed-off-by: Guillem Jover <guillem@debian.org> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-11-13 20:15:34 +00:00
.BR avc_destroy ()
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
destroys the userspace AVC, freeing all internal memory structures. After this call has been made,
libselinux: man: Fix man pages formatting - Add man page sections '(N)' to external references, and '()' on functions described in the same man page. - Escape minus signs when those are expected to be used on the command line or files. - Mark files and variables in italic; Note headings, function names, constants, program options and man page references in bold. - Do not justify and hyphenate SEE ALSO section, and avoid hyphenation on symbol names by prepending them with \%. - Remove trailing dot from NAME section description. - Split sections with a no-op command '.', to visually distinguish them but to avoid introducing spurious vertical space in the formatted output. - Add explicit .sp commands in the SYNOPSIS section between function prototypes, and fix space placement in function protoypes. - Split header includes with .br (instead of the explicit or implicit .sp) so that they are vertically contiguous. - Add missing {} around SELINUXTYPE and POLICYTYPE variable text in paths. - Remove unneeded formatting commands. - Remove spurious blank lines. Signed-off-by: Guillem Jover <guillem@debian.org> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-11-13 20:15:34 +00:00
.BR avc_open ()
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
must be called again before any AVC operations can be performed.
libselinux: man: Fix man pages formatting - Add man page sections '(N)' to external references, and '()' on functions described in the same man page. - Escape minus signs when those are expected to be used on the command line or files. - Mark files and variables in italic; Note headings, function names, constants, program options and man page references in bold. - Do not justify and hyphenate SEE ALSO section, and avoid hyphenation on symbol names by prepending them with \%. - Remove trailing dot from NAME section description. - Split sections with a no-op command '.', to visually distinguish them but to avoid introducing spurious vertical space in the formatted output. - Add explicit .sp commands in the SYNOPSIS section between function prototypes, and fix space placement in function protoypes. - Split header includes with .br (instead of the explicit or implicit .sp) so that they are vertically contiguous. - Add missing {} around SELINUXTYPE and POLICYTYPE variable text in paths. - Remove unneeded formatting commands. - Remove spurious blank lines. Signed-off-by: Guillem Jover <guillem@debian.org> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-11-13 20:15:34 +00:00
.BR avc_reset ()
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
flushes the userspace AVC, causing it to forget any cached access decisions. The userspace AVC normally calls this function automatically when needed, see
.B NETLINK NOTIFICATION
below.
libselinux: man: Fix man pages formatting - Add man page sections '(N)' to external references, and '()' on functions described in the same man page. - Escape minus signs when those are expected to be used on the command line or files. - Mark files and variables in italic; Note headings, function names, constants, program options and man page references in bold. - Do not justify and hyphenate SEE ALSO section, and avoid hyphenation on symbol names by prepending them with \%. - Remove trailing dot from NAME section description. - Split sections with a no-op command '.', to visually distinguish them but to avoid introducing spurious vertical space in the formatted output. - Add explicit .sp commands in the SYNOPSIS section between function prototypes, and fix space placement in function protoypes. - Split header includes with .br (instead of the explicit or implicit .sp) so that they are vertically contiguous. - Add missing {} around SELINUXTYPE and POLICYTYPE variable text in paths. - Remove unneeded formatting commands. - Remove spurious blank lines. Signed-off-by: Guillem Jover <guillem@debian.org> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-11-13 20:15:34 +00:00
.BR avc_cleanup ()
Documentation updates for the removal of recounted SID's. Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
2009-09-03 00:23:08 +00:00
attempts to free unused memory within the userspace AVC, but does not flush any cached access decisions. Under normal operation, calling this function should not be necessary.
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.SH "OPTIONS"
The userspace AVC obeys callbacks set via
.BR selinux_set_callback (3),
in particular the logging and audit callbacks.
The options which may be passed to
libselinux: man: Fix man pages formatting - Add man page sections '(N)' to external references, and '()' on functions described in the same man page. - Escape minus signs when those are expected to be used on the command line or files. - Mark files and variables in italic; Note headings, function names, constants, program options and man page references in bold. - Do not justify and hyphenate SEE ALSO section, and avoid hyphenation on symbol names by prepending them with \%. - Remove trailing dot from NAME section description. - Split sections with a no-op command '.', to visually distinguish them but to avoid introducing spurious vertical space in the formatted output. - Add explicit .sp commands in the SYNOPSIS section between function prototypes, and fix space placement in function protoypes. - Split header includes with .br (instead of the explicit or implicit .sp) so that they are vertically contiguous. - Add missing {} around SELINUXTYPE and POLICYTYPE variable text in paths. - Remove unneeded formatting commands. - Remove spurious blank lines. Signed-off-by: Guillem Jover <guillem@debian.org> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-11-13 20:15:34 +00:00
.BR avc_open ()
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
include the following:
.TP
.B AVC_OPT_SETENFORCE
This option forces the userspace AVC into enforcing mode if the option value is non-NULL; permissive mode otherwise. The system enforcing mode will be ignored.
libselinux: man: Fix man pages formatting - Add man page sections '(N)' to external references, and '()' on functions described in the same man page. - Escape minus signs when those are expected to be used on the command line or files. - Mark files and variables in italic; Note headings, function names, constants, program options and man page references in bold. - Do not justify and hyphenate SEE ALSO section, and avoid hyphenation on symbol names by prepending them with \%. - Remove trailing dot from NAME section description. - Split sections with a no-op command '.', to visually distinguish them but to avoid introducing spurious vertical space in the formatted output. - Add explicit .sp commands in the SYNOPSIS section between function prototypes, and fix space placement in function protoypes. - Split header includes with .br (instead of the explicit or implicit .sp) so that they are vertically contiguous. - Add missing {} around SELINUXTYPE and POLICYTYPE variable text in paths. - Remove unneeded formatting commands. - Remove spurious blank lines. Signed-off-by: Guillem Jover <guillem@debian.org> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-11-13 20:15:34 +00:00
.
libselinux: use kernel status page by default Commit bc2a8f418e3b ("libselinux: add selinux_status_* interfaces for /selinux/status") introduced the sestatus mechanism, which allows for mmap()'ing of the kernel status page as a replacement for avc_netlink. The mechanism was initially intended for userspace object managers that were calculating access decisions within their application and did not rely on the libselinux AVC implementation. In order to properly make use of sestatus within avc_has_perm(), the status mechanism needs to properly set avc internals during status events; else, avc_enforcing is never updated upon sestatus changes. This commit gets rid of the default avc_netlink_open() in avc_init_internal(), replacing it with selinux_status_open(). In the event that the kernel status page cannot be mapped, the netlink fallback will be used. By default, avc_has_perm_noaudit() and selinux_check_access() will now attempt to read the kernel status page, which removes a system call from two critical code paths. Since the AVC thread create/stop callbacks were intended to avoid a system call in the critical code path, they no longer need to be created by default. In the event that the kernel status page is successfully mapped, threads will not be created. Threads will still be created/stopped for the sestatus fallback codepaths. Userspace object managers that still need a netlink socket can call avc_netlink_acquire_fd() to open and/or obtain one. Update the manpage to reflect the new avc_netlink_acquire_fd() functionality. Signed-off-by: Mike Palmiotto <mike.palmiotto@crunchydata.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
2020-08-05 19:43:12 +00:00
.SH "KERNEL STATUS PAGE"
Linux kernel version 2.6.37 supports the SELinux kernel status page, enabling userspace applications to
.BR mmap (2)
SELinux status state in read-only mode to avoid system calls during the cache hit code path.
.BR avc_open ()
calls
.BR selinux_status_open (3)
to initialize the selinux status state.
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.BR avc_has_perm (3)
libselinux: use kernel status page by default Commit bc2a8f418e3b ("libselinux: add selinux_status_* interfaces for /selinux/status") introduced the sestatus mechanism, which allows for mmap()'ing of the kernel status page as a replacement for avc_netlink. The mechanism was initially intended for userspace object managers that were calculating access decisions within their application and did not rely on the libselinux AVC implementation. In order to properly make use of sestatus within avc_has_perm(), the status mechanism needs to properly set avc internals during status events; else, avc_enforcing is never updated upon sestatus changes. This commit gets rid of the default avc_netlink_open() in avc_init_internal(), replacing it with selinux_status_open(). In the event that the kernel status page cannot be mapped, the netlink fallback will be used. By default, avc_has_perm_noaudit() and selinux_check_access() will now attempt to read the kernel status page, which removes a system call from two critical code paths. Since the AVC thread create/stop callbacks were intended to avoid a system call in the critical code path, they no longer need to be created by default. In the event that the kernel status page is successfully mapped, threads will not be created. Threads will still be created/stopped for the sestatus fallback codepaths. Userspace object managers that still need a netlink socket can call avc_netlink_acquire_fd() to open and/or obtain one. Update the manpage to reflect the new avc_netlink_acquire_fd() functionality. Signed-off-by: Mike Palmiotto <mike.palmiotto@crunchydata.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
2020-08-05 19:43:12 +00:00
and
.BR selinux_check_access (3)
both check for status updates through calls to
.BR selinux_status_updated (3)
at the start of each permission query and take the appropriate action.
Two status types are currently implemented.
.B setenforce
events will change the effective enforcing state used within the AVC, and
.B policyload
events will result in a cache flush.
.
.SH "NETLINK NOTIFICATION"
In the event that the kernel status page is not successfully
.BR mmap (2)'ed
the AVC will default to the netlink fallback mechanism, which opens a netlink socket for receiving status updates.
.B setenforce
and
.B policyload
events will have the same results as for the status page implementation, but all status update checks will now require a system call.
libselinux: man: Fix man pages formatting - Add man page sections '(N)' to external references, and '()' on functions described in the same man page. - Escape minus signs when those are expected to be used on the command line or files. - Mark files and variables in italic; Note headings, function names, constants, program options and man page references in bold. - Do not justify and hyphenate SEE ALSO section, and avoid hyphenation on symbol names by prepending them with \%. - Remove trailing dot from NAME section description. - Split sections with a no-op command '.', to visually distinguish them but to avoid introducing spurious vertical space in the formatted output. - Add explicit .sp commands in the SYNOPSIS section between function prototypes, and fix space placement in function protoypes. - Split header includes with .br (instead of the explicit or implicit .sp) so that they are vertically contiguous. - Add missing {} around SELINUXTYPE and POLICYTYPE variable text in paths. - Remove unneeded formatting commands. - Remove spurious blank lines. Signed-off-by: Guillem Jover <guillem@debian.org> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-11-13 20:15:34 +00:00
.
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.SH "RETURN VALUE"
Functions with a return value return zero on success. On error, \-1 is returned and
.I errno
is set appropriately.
libselinux: man: Fix man pages formatting - Add man page sections '(N)' to external references, and '()' on functions described in the same man page. - Escape minus signs when those are expected to be used on the command line or files. - Mark files and variables in italic; Note headings, function names, constants, program options and man page references in bold. - Do not justify and hyphenate SEE ALSO section, and avoid hyphenation on symbol names by prepending them with \%. - Remove trailing dot from NAME section description. - Split sections with a no-op command '.', to visually distinguish them but to avoid introducing spurious vertical space in the formatted output. - Add explicit .sp commands in the SYNOPSIS section between function prototypes, and fix space placement in function protoypes. - Split header includes with .br (instead of the explicit or implicit .sp) so that they are vertically contiguous. - Add missing {} around SELINUXTYPE and POLICYTYPE variable text in paths. - Remove unneeded formatting commands. - Remove spurious blank lines. Signed-off-by: Guillem Jover <guillem@debian.org> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-11-13 20:15:34 +00:00
.
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.SH "AUTHOR"
Eamon Walsh <ewalsh@tycho.nsa.gov>
libselinux: man: Fix man pages formatting - Add man page sections '(N)' to external references, and '()' on functions described in the same man page. - Escape minus signs when those are expected to be used on the command line or files. - Mark files and variables in italic; Note headings, function names, constants, program options and man page references in bold. - Do not justify and hyphenate SEE ALSO section, and avoid hyphenation on symbol names by prepending them with \%. - Remove trailing dot from NAME section description. - Split sections with a no-op command '.', to visually distinguish them but to avoid introducing spurious vertical space in the formatted output. - Add explicit .sp commands in the SYNOPSIS section between function prototypes, and fix space placement in function protoypes. - Split header includes with .br (instead of the explicit or implicit .sp) so that they are vertically contiguous. - Add missing {} around SELINUXTYPE and POLICYTYPE variable text in paths. - Remove unneeded formatting commands. - Remove spurious blank lines. Signed-off-by: Guillem Jover <guillem@debian.org> Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-11-13 20:15:34 +00:00
.
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.SH "SEE ALSO"
.BR selinux (8),
libselinux: use kernel status page by default Commit bc2a8f418e3b ("libselinux: add selinux_status_* interfaces for /selinux/status") introduced the sestatus mechanism, which allows for mmap()'ing of the kernel status page as a replacement for avc_netlink. The mechanism was initially intended for userspace object managers that were calculating access decisions within their application and did not rely on the libselinux AVC implementation. In order to properly make use of sestatus within avc_has_perm(), the status mechanism needs to properly set avc internals during status events; else, avc_enforcing is never updated upon sestatus changes. This commit gets rid of the default avc_netlink_open() in avc_init_internal(), replacing it with selinux_status_open(). In the event that the kernel status page cannot be mapped, the netlink fallback will be used. By default, avc_has_perm_noaudit() and selinux_check_access() will now attempt to read the kernel status page, which removes a system call from two critical code paths. Since the AVC thread create/stop callbacks were intended to avoid a system call in the critical code path, they no longer need to be created by default. In the event that the kernel status page is successfully mapped, threads will not be created. Threads will still be created/stopped for the sestatus fallback codepaths. Userspace object managers that still need a netlink socket can call avc_netlink_acquire_fd() to open and/or obtain one. Update the manpage to reflect the new avc_netlink_acquire_fd() functionality. Signed-off-by: Mike Palmiotto <mike.palmiotto@crunchydata.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
2020-08-05 19:43:12 +00:00
.BR selinux_check_access (3),
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.BR avc_has_perm (3),
.BR avc_context_to_sid (3),
.BR avc_cache_stats (3),
.BR avc_add_callback (3),
libselinux: use kernel status page by default Commit bc2a8f418e3b ("libselinux: add selinux_status_* interfaces for /selinux/status") introduced the sestatus mechanism, which allows for mmap()'ing of the kernel status page as a replacement for avc_netlink. The mechanism was initially intended for userspace object managers that were calculating access decisions within their application and did not rely on the libselinux AVC implementation. In order to properly make use of sestatus within avc_has_perm(), the status mechanism needs to properly set avc internals during status events; else, avc_enforcing is never updated upon sestatus changes. This commit gets rid of the default avc_netlink_open() in avc_init_internal(), replacing it with selinux_status_open(). In the event that the kernel status page cannot be mapped, the netlink fallback will be used. By default, avc_has_perm_noaudit() and selinux_check_access() will now attempt to read the kernel status page, which removes a system call from two critical code paths. Since the AVC thread create/stop callbacks were intended to avoid a system call in the critical code path, they no longer need to be created by default. In the event that the kernel status page is successfully mapped, threads will not be created. Threads will still be created/stopped for the sestatus fallback codepaths. Userspace object managers that still need a netlink socket can call avc_netlink_acquire_fd() to open and/or obtain one. Update the manpage to reflect the new avc_netlink_acquire_fd() functionality. Signed-off-by: Mike Palmiotto <mike.palmiotto@crunchydata.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
2020-08-05 19:43:12 +00:00
.BR selinux_status_open (3),
.BR selinux_status_updated (3),
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.BR selinux_set_callback (3),
.BR security_compute_av (3)
Reference in New Issue Copy Permalink