mirror of
https://github.com/SELinuxProject/selinux
synced 2024-12-14 01:54:42 +00:00
6ef13eeda7
- Add man page sections '(N)' to external references, and '()' on
functions described in the same man page.
- Escape minus signs when those are expected to be used on the command
line or files.
- Mark files and variables in italic; Note headings, function names,
constants, program options and man page references in bold.
- Do not justify and hyphenate SEE ALSO section, and avoid hyphenation
on symbol names by prepending them with \%.
- Remove trailing dot from NAME section description.
- Split sections with a no-op command '.', to visually distinguish them
but to avoid introducing spurious vertical space in the formatted
output.
- Add explicit .sp commands in the SYNOPSIS section between function
prototypes, and fix space placement in function protoypes.
- Split header includes with .br (instead of the explicit or implicit
.sp) so that they are vertically contiguous.
- Add missing {} around SELINUXTYPE and POLICYTYPE variable text in
paths.
- Remove unneeded formatting commands.
- Remove spurious blank lines.
Signed-off-by: Guillem Jover <guillem@debian.org>
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
113 lines
4.2 KiB
Groff
113 lines
4.2 KiB
Groff
.TH "security_compute_av" "3" "1 January 2004" "russell@coker.com.au" "SELinux API documentation"
|
|
.SH "NAME"
|
|
security_compute_av, security_compute_av_flags, security_compute_create, security_compute_create_name, security_compute_relabel,
|
|
security_compute_member, security_compute_user, security_get_initial_context \- query
|
|
the SELinux policy database in the kernel
|
|
.
|
|
.SH "SYNOPSIS"
|
|
.B #include <selinux/selinux.h>
|
|
.br
|
|
.B #include <selinux/flask.h>
|
|
.sp
|
|
.BI "int security_compute_av(security_context_t "scon ", security_context_t "tcon ", security_class_t "tclass ", access_vector_t "requested ", struct av_decision *" avd );
|
|
.sp
|
|
.BI "int security_compute_av_flags(security_context_t "scon ", security_context_t "tcon ", security_class_t "tclass ", access_vector_t "requested ", struct av_decision *" avd );
|
|
.sp
|
|
.BI "int security_compute_create(security_context_t "scon ", security_context_t "tcon ", security_class_t "tclass ", security_context_t *" newcon );
|
|
.sp
|
|
.BI "int security_compute_create_name(security_context_t "scon ", security_context_t "tcon ", security_class_t "tclass ", const char *"objname ", security_context_t *" newcon );
|
|
.sp
|
|
.BI "int security_compute_relabel(security_context_t "scon ", security_context_t "tcon ", security_class_t "tclass ", security_context_t *" newcon );
|
|
.sp
|
|
.BI "int security_compute_member(security_context_t "scon ", security_context_t "tcon ", security_class_t "tclass ", security_context_t *" newcon );
|
|
.sp
|
|
.BI "int security_compute_user(security_context_t "scon ", const char *" username ", security_context_t **" con );
|
|
.sp
|
|
.BI "int security_get_initial_context(const char *" name ", security_context_t " con );
|
|
.sp
|
|
.BI "int selinux_check_access(const security_context_t " scon ", const security_context_t " tcon ", const char *" class ", const char *" perm ", void *" auditdata);
|
|
.sp
|
|
.BI "int selinux_check_passwd_access(access_vector_t " requested );
|
|
.sp
|
|
.BI "int checkPasswdAccess(access_vector_t " requested );
|
|
.
|
|
.SH "DESCRIPTION"
|
|
.BR security_compute_av ()
|
|
queries whether the policy permits the source context
|
|
.I scon
|
|
to access the target context
|
|
.I tcon
|
|
via class
|
|
.I tclass
|
|
with the
|
|
.I requested
|
|
access vector. The decision is returned in
|
|
.IR avd .
|
|
|
|
.BR security_compute_av_flags ()
|
|
is identical to
|
|
.B security_compute_av
|
|
but additionally sets the
|
|
.I flags
|
|
field of
|
|
.IR avd .
|
|
Currently one flag is supported:
|
|
.BR SELINUX_AVD_FLAGS_PERMISSIVE ,
|
|
which indicates the decision is computed on a permissive domain.
|
|
|
|
.BR security_compute_create ()
|
|
is used to compute a context to use for labeling a new object in a particular
|
|
class based on a SID pair.
|
|
|
|
.BR security_compute_create_name ()
|
|
is identical to
|
|
.BR \%security_compute_create ()
|
|
but also takes name of the new object in creation as an argument.
|
|
When
|
|
.B TYPE_TRANSITION
|
|
rule on the given class and a SID pair has object name extension,
|
|
we shall be able to obtain a correct
|
|
.I newcon
|
|
according to the security policy. Note that this interface is only
|
|
supported on the linux 2.6.40 or later.
|
|
In the older kernel, the object name will be simply ignored.
|
|
|
|
.BR security_compute_relabel ()
|
|
is used to compute the new context to use when relabeling an object, it is used
|
|
in the pam_selinux.so source and the newrole source to determine the correct
|
|
label for the tty at login time, but can be used for other things.
|
|
|
|
.BR security_compute_member ()
|
|
is used to compute the context to use when labeling a polyinstantiated object
|
|
instance.
|
|
|
|
.BR security_compute_user ()
|
|
is used to determine the set of user contexts that can be reached from a
|
|
source context. It is mainly used by
|
|
.BR get_ordered_context_list ().
|
|
|
|
.BR security_get_initial_context ()
|
|
is used to get the context of a kernel initial security identifier specified by
|
|
.I name
|
|
|
|
.BR selinux_check_access ()
|
|
is used to check if the source context has the access permission for the specified class on the target context.
|
|
|
|
.BR selinux_check_passwd_access ()
|
|
is used to check for a permission in the
|
|
.I passwd
|
|
class.
|
|
.BR selinux_check_passwd_access ()
|
|
uses getprevcon() for the source and target security contexts.
|
|
|
|
.BR checkPasswdAccess ()
|
|
is a deprecated alias of the
|
|
.BR selinux_check_passwd_access ()
|
|
function.
|
|
.
|
|
.SH "RETURN VALUE"
|
|
Returns zero on success or \-1 on error.
|
|
.
|
|
.SH "SEE ALSO"
|
|
.BR selinux "(8), " getcon "(3), " getfilecon "(3), " get_ordered_context_list "(3)"
|