selinux\_set\_callback(3) SELinux API documentation selinux\_set\_callback(3)

# [NAME](#NAME)

selinux\_set\_callback - userspace SELinux callback facilities

# [SYNOPSIS](#SYNOPSIS)

**#include <selinux/selinux.h>**

**void selinux\_set\_callback(int type, union selinux\_callback callback);**

# [DESCRIPTION](#DESCRIPTION)

**selinux\_set\_callback**() sets the callback indicated by *type* to the value of *callback*, which should be passed as a function pointer cast to type **union** **selinux\_callback**.

All callback functions should return a negative value with *errno* set appropriately on error.

The available values for *type* are:

[**SELINUX\_CB\_LOG**](#SELINUX_CB_LOG)

**int (\*func\_log) (int type, const char \*fmt, ...);**

This callback is used for logging and should process the [**printf**(3)](/man/os/libselinux/printf.3) style *fmt* string and arguments as appropriate. The *type* argument indicates the type of message and will be set to one of the following:

**SELINUX\_ERROR**

**SELINUX\_WARNING**

**SELINUX\_INFO**

**SELINUX\_AVC**

**SELINUX\_POLICYLOAD**

**SELINUX\_SETENFORCE**

SELINUX\_ERROR, SELINUX\_WARNING, and SELINUX\_INFO indicate standard log severity levels and are not auditable messages.

The SELINUX\_AVC, SELINUX\_POLICYLOAD, and SELINUX\_SETENFORCE message types can be audited with AUDIT\_USER\_AVC, AUDIT\_USER\_MAC\_POLICY\_LOAD, and AUDIT\_USER\_MAC\_STATUS values from libaudit, respectively. If they are not audited, SELINUX\_AVC should be considered equivalent to SELINUX\_ERROR; similarly, SELINUX\_POLICYLOAD and SELINUX\_SETENFORCE should be considered equivalent to SELINUX\_INFO.

[**SELINUX\_CB\_AUDIT**](#SELINUX_CB_AUDIT)

**int (\*func\_audit) (void \*auditdata, security\_class\_t cls,**  
**char \*msgbuf, size\_t msgbufsize);**

This callback is used for supplemental auditing in AVC messages. The *auditdata* and *cls* arguments are the values passed to [**avc\_has\_perm**(3)](/man/os/libselinux/avc_has_perm.3). A human-readable interpretation should be printed to *msgbuf* using no more than *msgbufsize* characters.

[**SELINUX\_CB\_VALIDATE**](#SELINUX_CB_VALIDATE)

**int (\*func\_validate) (char \*\*ctx);**

This callback is used for context validation. The callback may optionally modify the input context by setting the target of the *ctx* pointer to a new context. In this case, the old value should be freed with [**freecon**(3)](/man/os/libselinux/freecon.3). The value of *errno* should be set to **EINVAL** to indicate an invalid context.

[**SELINUX\_CB\_SETENFORCE**](#SELINUX_CB_SETENFORCE)

**int (\*func\_setenforce) (int enforcing);**

This callback is invoked when the system enforcing state changes. The *enforcing* argument indicates the new value and is set to *1* for enforcing mode, and *0* for permissive mode.

[**SELINUX\_CB\_POLICYLOAD**](#SELINUX_CB_POLICYLOAD)

**int (\*func\_policyload) (int seqno);**

This callback is invoked when the system security policy is reloaded. The *seqno* argument is the current sequential number of the policy generation in the system.

# [RETURN VALUE](#RETURN_VALUE)

None.

# [ERRORS](#ERRORS)

None.

# [AUTHOR](#AUTHOR)

Eamon Walsh <ewalsh@tycho.nsa.gov>

# [SEE ALSO](#SEE_ALSO)

[**selabel\_open**(3)](/man/os/libselinux/selabel_open.3), [**avc\_init**(3)](/man/os/libselinux/avc_init.3), [**avc\_netlink\_open**(3)](/man/os/libselinux/avc_netlink_open.3), [**selinux**(8)](/man/os/libselinux/selinux.8)

20 Jun 2007

---

Document: selinux_set_callback(3) from libselinux 3.11-r2 (Chainguard OS)
Source: https://github.com/SELinuxProject/selinux.git