The context returned by avc_sid_to_context
must be freed by the caller using freecon
.
Remember that avc_context_to_sid
increments SID reference counts. If you pass the same context three times to this function, the SID for that context will have a count of 3. This behavior supports obtaining SIDs to assign to newly created objects.
libselinux has facilities for converting from security classes and access vectors into strings and vice versa.
avc_has_perm_noaudit
can be used to perform a permission check without auditing. The decision returned by this function can be passed to avc_audit
to produce the message. See the implementation of avc_has_perm
.
When experimenting with new policy, note that avc_has_perm*
will return -1 with errno set to EINVAL on an invalid security context or security class (this is what security_compute_av
returns). No audit message is logged in this case.
If a netlink socket error occurs in single-threaded mode, avc_has_perm*
will log a message and return with errno set to whatever the socket routine returned. Note that this value might be EACCES (the "normal" errno value for a policy denial).
If a netlink socket error occurs in threaded mode, the netlink thread will log a message and then terminate. At this point, avc_has_perm*
will return EINVAL until the userspace AVC is destroyed and reinitialized.
The userspace AVC produces a log message whenever a netlink notification is processed. Note that in non-threaded mode netlink messages are not processed until the next call to avc_has_perm*
.
In addition to SIDs, consider storing an avc_entry_ref
structure in each managed object. These structures are passed to avc_has_perm
and can increase performance on repeated permission checks. Remember to initialize the structures with the avc_entry_ref_init
macro.
avc_cleanup
can be called periodically to free up memory in the userspace AVC.
avc_reset
will flush all cached access decisions and reset the userspace AVC's internal statistics. The SID table, however, is not affected. A call to this function is made internally when a netlink policy change notification arrives.