6ef13eeda7
- Add man page sections '(N)' to external references, and '()' on
functions described in the same man page.
- Escape minus signs when those are expected to be used on the command
line or files.
- Mark files and variables in italic; Note headings, function names,
constants, program options and man page references in bold.
- Do not justify and hyphenate SEE ALSO section, and avoid hyphenation
on symbol names by prepending them with \%.
- Remove trailing dot from NAME section description.
- Split sections with a no-op command '.', to visually distinguish them
but to avoid introducing spurious vertical space in the formatted
output.
- Add explicit .sp commands in the SYNOPSIS section between function
prototypes, and fix space placement in function protoypes.
- Split header includes with .br (instead of the explicit or implicit
.sp) so that they are vertically contiguous.
- Add missing {} around SELINUXTYPE and POLICYTYPE variable text in
paths.
- Remove unneeded formatting commands.
- Remove spurious blank lines.
Signed-off-by: Guillem Jover <guillem@debian.org>
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
69 lines
2.6 KiB
Groff
69 lines
2.6 KiB
Groff
.\" Hey Emacs! This file is -*- nroff -*- source.
|
|
.\"
|
|
.\" Author: Eamon Walsh (ewalsh@tycho.nsa.gov) 2008
|
|
.TH "avc_open" "3" "12 Jun 2008" "" "SELinux API documentation"
|
|
.SH "NAME"
|
|
avc_open, avc_destroy, avc_reset, avc_cleanup \- userspace SELinux AVC setup and teardown
|
|
.
|
|
.SH "SYNOPSIS"
|
|
.B #include <selinux/selinux.h>
|
|
.br
|
|
.B #include <selinux/avc.h>
|
|
.sp
|
|
.BI "int avc_open(struct selinux_opt *" options ", unsigned " nopt ");"
|
|
.sp
|
|
.BI "void avc_destroy(void);"
|
|
.sp
|
|
.BI "int avc_reset(void);"
|
|
.sp
|
|
.BI "void avc_cleanup(void);"
|
|
.
|
|
.SH "DESCRIPTION"
|
|
.BR avc_open ()
|
|
initializes the userspace AVC and must be called before any other AVC operation can be performed.
|
|
|
|
.BR avc_destroy ()
|
|
destroys the userspace AVC, freeing all internal memory structures. After this call has been made,
|
|
.BR avc_open ()
|
|
must be called again before any AVC operations can be performed.
|
|
|
|
.BR avc_reset ()
|
|
flushes the userspace AVC, causing it to forget any cached access decisions. The userspace AVC normally calls this function automatically when needed, see
|
|
.B NETLINK NOTIFICATION
|
|
below.
|
|
|
|
.BR avc_cleanup ()
|
|
attempts to free unused memory within the userspace AVC, but does not flush any cached access decisions. Under normal operation, calling this function should not be necessary.
|
|
.SH "OPTIONS"
|
|
The userspace AVC obeys callbacks set via
|
|
.BR selinux_set_callback (3),
|
|
in particular the logging and audit callbacks.
|
|
|
|
The options which may be passed to
|
|
.BR avc_open ()
|
|
include the following:
|
|
.TP
|
|
.B AVC_OPT_SETENFORCE
|
|
This option forces the userspace AVC into enforcing mode if the option value is non-NULL; permissive mode otherwise. The system enforcing mode will be ignored.
|
|
.
|
|
.SH "NETLINK NOTIFICATION"
|
|
Beginning with version 2.6.4, the Linux kernel supports SELinux status change notification via netlink. Two message types are currently implemented, indicating changes to the enforcing mode and to the loaded policy in the kernel, respectively. The userspace AVC listens for these messages and takes the appropriate action, modifying the behavior of
|
|
.BR avc_has_perm (3)
|
|
to reflect the current enforcing mode and flushing the cache on receipt of a policy load notification. Audit messages are produced when netlink notifications are processed.
|
|
.
|
|
.SH "RETURN VALUE"
|
|
Functions with a return value return zero on success. On error, \-1 is returned and
|
|
.I errno
|
|
is set appropriately.
|
|
.
|
|
.SH "AUTHOR"
|
|
Eamon Walsh <ewalsh@tycho.nsa.gov>
|
|
.
|
|
.SH "SEE ALSO"
|
|
.BR selinux (8),
|
|
.BR avc_has_perm (3),
|
|
.BR avc_context_to_sid (3),
|
|
.BR avc_cache_stats (3),
|
|
.BR avc_add_callback (3),
|
|
.BR selinux_set_callback (3),
|
|
.BR security_compute_av (3)
|