selinux\_status\_open(3) SELinux API documentation selinux\_status\_open(3)

# [NAME](#NAME)

selinux\_status\_open, selinux\_status\_close, selinux\_status\_updated, selinux\_status\_getenforce, selinux\_status\_policyload and selinux\_status\_deny\_unknown - reference the SELinux kernel status without invocation of system calls

# [SYNOPSIS](#SYNOPSIS)

**#include <selinux/avc.h>**

**int selinux\_status\_open(int fallback);**

**void selinux\_status\_close(void);**

**int selinux\_status\_updated(void);**

**int selinux\_status\_getenforce(void);**

**int selinux\_status\_policyload(void);**

**int selinux\_status\_deny\_unknown(void);**

# [DESCRIPTION](#DESCRIPTION)

Linux 2.6.37 or later provides a SELinux kernel status page; being mostly placed on */sys/fs/selinux/status* entry. It enables userspace applications to mmap this page with read-only mode, then it informs some status without system call invocations.

In some cases that a userspace application tries to apply heavy frequent access control; such as row-level security in databases, it will face unignorable cost to communicate with kernel space to check invalidation of userspace avc.

These functions provides applications a way to know some kernel events without system-call invocation or worker thread for monitoring.

**selinux\_status\_open**() tries to [**open**(2)](/man/os/libselinux/open.2) */sys/fs/selinux/status* and [**mmap**(2)](/man/os/libselinux/mmap.2) it in read-only mode. The file-descriptor and pointer to the page shall be stored internally; Don't touch them directly. Set 1 on the *fallback* argument to handle a case of older kernels without kernel status page support. In this case, this function tries to open a netlink socket using [**avc\_netlink\_open**(3)](/man/os/libselinux/avc_netlink_open.3) and overwrite corresponding callbacks (setenforce and policyload). Thus, we need to pay attention to the interaction with these interfaces, when fallback mode is enabled.

**selinux\_status\_close**() unmap the kernel status page and close its file descriptor, or close the netlink socket if fallbacked.

**selinux\_status\_updated**() processes status update events. There are two kinds of status updates. **setenforce** events will change the effective enforcing state used within the AVC, and **policyload** events will result in a cache flush.

This function returns 0 if there have been no updates since the last call, 1 if there have been updates since the last call, or -1 on error.

**selinux\_status\_getenforce**() returns 0 if SELinux is running in permissive mode, 1 if enforcing mode, or -1 on error. Same as [**security\_getenforce**(3)](/man/os/libselinux/security_getenforce.3) except with or without system call invocation.

**selinux\_status\_policyload**() returns times of policy reloaded on the running system, or -1 on error. Note that it is not a reliable value on fallback-mode until it receive the first event message via netlink socket. Thus, don't use this value to know actual times of policy reloaded.

**selinux\_status\_deny\_unknown**() returns 0 if SELinux treats policy queries on undefined object classes or permissions as being allowed, 1 if such queries are denied, or -1 on error.

# [RETURN VALUE](#RETURN_VALUE)

**selinux\_status\_open**() returns 0 or 1 on success. 1 means we are ready to use these interfaces, but netlink socket was opened as fallback instead of the kernel status page. On error, -1 shall be returned.

Any other functions with a return value shall return its characteristic value as described above, or -1 on errors.

# [CAVEATS](#CAVEATS)

These functions are not thread-safe, you have to protect them from concurrent calls using exclusive locks when multiple threads are executing.

# [SEE ALSO](#SEE_ALSO)

[**mmap**(2)](/man/os/libselinux/mmap.2), [**avc\_netlink\_open**(3)](/man/os/libselinux/avc_netlink_open.3), [**security\_getenforce**(3)](/man/os/libselinux/security_getenforce.3), [**security\_deny\_unknown**(3)](/man/os/libselinux/security_deny_unknown.3)

22 January 2011 kaigai@ak.jp.nec.com

---

Document: selinux_status_policyload(3) from libselinux 3.11-r2 (Chainguard OS)
Source: https://github.com/SELinuxProject/selinux.git