next up previous contents index
Next: 11.3.4 remove_callback: Remove a Up: 11.3 oskit_avc: AVC Interface Previous: 11.3.2 notify_perm_ref: Notify of

11.3.3 add_callback: Register a callback for a policy change event

 

SYNOPSIS

#include <oskit/flask/avc.h>

OSKIT_COMDECL oskit_avc_add_callback(oskit_avc_t *avc, oskit_avc_callback_t *callback, oskit_u32_t events, oskit_security_id_t ssid, oskit_security_id_t tsid, oskit_security_class_t tclass, oskit_access_vector_t perms);

DESCRIPTION

The oskit_avc_add_callback function registers an object manager callback function callback with the AVC component for policy change notifications. When the security server calls an AVC interface that corresponds to an event in the set events with a SID pair, class and permissions that match ssid, tsid, tclass and perms, the AVC component calls the registered callback function with the parameters provided by the security server. The callback function may then update any affected permissions that are retained in the state of the object manager. The wildcard SID, OSKIT_SECSID_WILD, may be used for the ssid and tsid parameters to match all SID values. Permission vectors match if they have a non-null intersection. The meaning of each event value is explained in the description of the corresponding interface in the next section.

PARAMETERS

avc
The access vector cache.
callback
The callback.
events
The events. Legal events are:
OSKIT_AVC_CALLBACK_GRANT
Grant permissions.
OSKIT_AVC_CALLBACK_TRY_REVOKE
Revoke permissions if not r etained.
OSKIT_AVC_CALLBACK_REVOKE
Revoke permissions.
OSKIT_AVC_CALLBACK_RESET
Recheck permissions.
OSKIT_AVC_CALLBACK_AUDITALLOW_ENABLE
Enable auditing of p ermission grantings.
OSKIT_AVC_CALLBACK_AUDITALLOW_DISABLE
Disable auditing of permission grantings.
OSKIT_AVC_CALLBACK_AUDITDENY_ENABLE
Enable auditing of pe rmission denials.
OSKIT_AVC_CALLBACK_AUDITDENY_DISABLE
Disable auditing of permission denials.

ssid
The source SID.
tsid
The target SID.
tclass
The target object security class.
perms
The permissions.

RETURNS

Returns 0 on success, or an error code specified in <oskit/error.h>, on error.



Utah Flux Research Group