next up previous contents index
Next: 11.3.2 notify_perm_ref: Notify of Up: 11.3 oskit_avc: AVC Interface Previous: 11.3 oskit_avc: AVC Interface

11.3.1 has_perm_ref: Check permissions

 

SYNOPSIS

#include <oskit/flask/avc.h>

OSKIT_COMDECL oskit_avc_has_perm_ref(oskit_avc_t *avc, oskit_security_id_t ssid, oskit_security_id_t tsid, oskit_security_class_t tclass, oskit_access_vector_t requested, [in/out] oskit_avc_entry_ref_t *aeref);

DESCRIPTION

The oskit_avc_has_perm_ref inline function determines whether the requested permissions are granted for the specified SID pair and class. If aeref refers to a valid AVC entry for this permission check, then the referenced entry is used. Otherwise, this function obtains a valid entry and sets aeref to refer to this entry. To obtain a valid entry, this function first searches the cache. If this fails, then this function calls the oskit_security_compute_av interface of the security server to compute the access vectors and adds a new entry to the cache. If the appropriate audit access vector (auditallow or auditdeny) in the entry indicates that the permission check should be audited, then this function audits the permission check.

The object managers call this function to perform permission checks. Object managers may also use a variant of this function, avc_has_perm, in order to omit the reference parameter.

PARAMETERS

avc
The access vector cache.
ssid
The source SID.
tsid
The target SID.
tclass
The target object class.
requested
The permissions to be checked.
aeref
The reference to an AVC entry.

RETURNS

This function returns 0 if permission is granted. If the security server returns an error upon a oskit_security_compute_av call, then this function returns that error. If the security server returns a sequence number that is less than the latest policy change sequence number, then this function discards the security server response and returns OSKIT_EAGAIN. If permission is denied, then this function returns OSKIT_EACCES.



Utah Flux Research Group