157 lines
4.8 KiB
HTML
157 lines
4.8 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of selinux_status_open</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>selinux_status_open</H1>
|
|
Section: SELinux API documentation (3)<BR>Updated: 22 January 2011<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
selinux_status_open, selinux_status_close, selinux_status_updated,
|
|
selinux_status_getenforce, selinux_status_policyload and
|
|
selinux_status_deny_unknown - reference the SELinux kernel status
|
|
without invocation of system calls
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<B>#include <<A HREF="file:///usr/include/selinux/avc.h">selinux/avc.h</A>></B>
|
|
|
|
<P>
|
|
<B>int selinux_status_open(int </B><I>fallback</I><B>);</B>
|
|
|
|
<P>
|
|
<B>void selinux_status_close(void);</B>
|
|
|
|
<P>
|
|
<B>int selinux_status_updated(void);</B>
|
|
|
|
<P>
|
|
<B>int selinux_status_getenforce(void);</B>
|
|
|
|
<P>
|
|
<B>int selinux_status_policyload(void);</B>
|
|
|
|
<P>
|
|
<B>int selinux_status_deny_unknown(void);</B>
|
|
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
Linux 2.6.37 or later provides a SELinux kernel status page; being mostly
|
|
placed on
|
|
<I>/sys/fs/selinux/status</I>
|
|
|
|
entry. It enables userspace applications to mmap this page with read-only
|
|
mode, then it informs some status without system call invocations.
|
|
<P>
|
|
In some cases that a userspace application tries to apply heavy frequent
|
|
access control; such as row-level security in databases, it will face
|
|
unignorable cost to communicate with kernel space to check invalidation
|
|
of userspace avc.
|
|
<P>
|
|
These functions provides applications a way to know some kernel events
|
|
without system-call invocation or worker thread for monitoring.
|
|
<P>
|
|
<B>selinux_status_open</B>()
|
|
|
|
tries to
|
|
<B><A HREF="/cgi-bin/man/man2html?2+open">open</A></B>(2)
|
|
|
|
<I>/sys/fs/selinux/status</I>
|
|
|
|
and
|
|
<B><A HREF="/cgi-bin/man/man2html?2+mmap">mmap</A></B>(2)
|
|
|
|
it in read-only mode. The file-descriptor and pointer to the page shall
|
|
be stored internally; Don't touch them directly.
|
|
Set 1 on the
|
|
<I>fallback</I>
|
|
|
|
argument to handle a case of older kernels without kernel status page support.
|
|
In this case, this function tries to open a netlink socket using
|
|
<B><A HREF="/cgi-bin/man/man2html?3+avc_netlink_open">avc_netlink_open</A></B>(3)
|
|
|
|
and overwrite corresponding callbacks ( setenforce and policyload).
|
|
Thus, we need to pay attention to the interaction with these interfaces,
|
|
when fallback mode is enabled.
|
|
<P>
|
|
<B>selinux_status_close</B>()
|
|
|
|
unmap the kernel status page and close its file descriptor, or close the
|
|
netlink socket if fallbacked.
|
|
<P>
|
|
<B>selinux_status_updated</B>()
|
|
|
|
informs us whether something has been updated since the last call.
|
|
It returns 0 if nothing was happened, however, 1 if something has been
|
|
updated in this duration, or -1 on error.
|
|
<P>
|
|
<B>selinux_status_getenforce</B>()
|
|
|
|
returns 0 if SELinux is running in permissive mode, 1 if enforcing mode,
|
|
or -1 on error.
|
|
Same as
|
|
<B><A HREF="/cgi-bin/man/man2html?3+security_getenforce">security_getenforce</A></B>(3)
|
|
|
|
except with or without system call invocation.
|
|
<P>
|
|
<B>selinux_status_policyload</B>()
|
|
|
|
returns times of policy reloaded on the running system, or -1 on error.
|
|
Note that it is not a reliable value on fallback-mode until it receive
|
|
the first event message via netlink socket.
|
|
Thus, don't use this value to know actual times of policy reloaded.
|
|
<P>
|
|
<B>selinux_status_deny_unknown</B>()
|
|
|
|
returns 0 if SELinux treats policy queries on undefined object classes or
|
|
permissions as being allowed, 1 if such queries are denied, or -1 on error.
|
|
<P>
|
|
Also note that these interfaces are not thread-safe, so you have to protect
|
|
them from concurrent calls using exclusive locks when multiple threads are
|
|
performing.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>RETURN VALUE</H2>
|
|
|
|
<B>selinux_status_open</B>()
|
|
|
|
returns 0 or 1 on success. 1 means we are ready to use these interfaces,
|
|
but netlink socket was opened as fallback instead of the kernel status page.
|
|
On error, -1 shall be returned.
|
|
<P>
|
|
Any other functions with a return value shall return its characteristic
|
|
value as described above, or -1 on errors.
|
|
<A NAME="lbAF"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?2+mmap">mmap</A></B>(2),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+avc_netlink_open">avc_netlink_open</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+security_getenforce">security_getenforce</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+security_deny_unknown">security_deny_unknown</A></B>(3)
|
|
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="1"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="2"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="3"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="4"><A HREF="#lbAE">RETURN VALUE</A><DD>
|
|
<DT id="5"><A HREF="#lbAF">SEE ALSO</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:05:56 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|