---
name: "security_compute_av"
section: "2"
platform: "linux"
package: "libselinux-dev"
version: "2002031409-4"
release: "Debian 3.0 (Woody)"
platforms: ["linux"]
url: "https://new.carta.tech/security_compute_av"
---

# security\_compute\_av(2)

Compute access vectors

## NAME

security\_compute\_av - Compute access vectors

## SYNOPSIS

**#include \<ss.h\>**

**int security\_compute\_av(struct security\_query \****query***, struct security\_response \****response***);**

## DESCRIPTION

The  **security\_compute\_av** call is used to compute access vectors based on a SID pair for  the permissions in a particular class.  The input parameters are supplied in a  **security\_query** structure, and the computed access vectors are returned in a  **security\_response** structure:

-

  ```
  struct security_query {
  	security_id_t	ssid;	/* source SID */
  	security_id_t	tsid;	/* target SID */
  	security_class_t	tclass; /* target object class */
  	access_vector_t	requested;	/* requested permissions */
  }
  struct security_response {
  	access_vector_t	allowed;	/* granted permissions */
  	access_vector_t	decided;	/* decided permissions */
  	access_vector_t	auditallow;	/* audit when granted */
  	access_vector_t	auditdeny;	/* audit when denied */
  	access_vector_t	notify;		/* notify when used */
  	__u32		seqno;		/* sequence number */
  }
  ```

The  *allowed* access vector contains the set of granted permissions. The  *decided* access vector contains the set of permissions for which a decision was returned.  Every permission in the *requested* access vector will be in this set, but other permission decisions may be deferred until explicitly requested.

The *auditallow* access vector contains the set of permissions that should be audited when they are granted. The  *auditdeny* access vector contains the set of permissions that should be audited when they are denied. The  *notify* access vector contains the set of permissions for which  **security\_notify\_perm** should be invoked when the operation associated with the permission has successfully completed.

The *seqno* value may be used to determine the relative ordering of the computation with a revocation.  The *response* should only be used if the *seqno* is greater than or equal to the largest sequence number that has been used for a revocation notification.

## RETURN VALUE

A zero is returned if the computation was successful, even if the  *requested* permissions were not granted. On error, -1 is returned, and  *errno* is set appropriately.

## ERRORS

- **EINVAL**

  The source SID, target SID or target class was invalid.

- **EACCES**

  The process is not authorized to invoke this call.

## SEE ALSO

[**security\_compute\_av**(2)](/security_compute_av/2.md), [**security\_sid\_to\_context**(2)](/security_sid_to_context/2.md), [**security\_context\_to\_sid**(2)](/security_context_to_sid/2.md), [**security\_transition\_sid**(2)](/security_transition_sid/2.md), [**security\_member\_sid**(2)](/security_member_sid/2.md), [**security\_load\_policy**(2)](/security_load_policy/2.md), [**security\_notify\_perm**(2)](/security_notify_perm/2.md), [**security\_get\_sids**(2)](/security_get_sids/2.md)