---
name: "selinux_set_callback"
section: "3"
platform: "linux"
package: "libselinux1-dev"
version: "3.8.1-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/selinux_set_callback"
---

# selinux\_set\_callback(3)

userspace SELinux callback facilities

## NAME

selinux\_set\_callback - userspace SELinux callback facilities

## SYNOPSIS

**#include \<selinux/selinux.h\>**

**void selinux\_set\_callback(int** *type***, union selinux\_callback** *callback***);**

## DESCRIPTION

**selinux\_set\_callback**() sets the callback indicated by *type* to the value of *callback*, which should be passed as a function pointer cast to type **union** **selinux\_callback**.

All callback functions should return a negative value with *errno* set appropriately on error.

The available values for  *type* are:

- **SELINUX\_CB\_LOG**

  **int (\****func\_log***) (int** *type***, const char \****fmt***, ...);**

  This callback is used for logging and should process the  [**printf**(3)](/printf/3.md) style  *fmt* string and arguments as appropriate.  The *type* argument indicates the type of message and will be set to one of the following:

  **SELINUX\_ERROR**

  **SELINUX\_WARNING**

  **SELINUX\_INFO**

  **SELINUX\_AVC**

  **SELINUX\_POLICYLOAD**

  **SELINUX\_SETENFORCE**

  SELINUX\_ERROR, SELINUX\_WARNING, and SELINUX\_INFO indicate standard log severity levels and are not auditable messages.

  The SELINUX\_AVC, SELINUX\_POLICYLOAD, and SELINUX\_SETENFORCE message types can be audited with AUDIT\_USER\_AVC, AUDIT\_USER\_MAC\_POLICY\_LOAD, and AUDIT\_USER\_MAC\_STATUS values from libaudit, respectively.  If they are not audited, SELINUX\_AVC should be considered equivalent to SELINUX\_ERROR; similarly, SELINUX\_POLICYLOAD and SELINUX\_SETENFORCE should be considered equivalent to SELINUX\_INFO.

- **SELINUX\_CB\_AUDIT**

  **int (\****func\_audit***) (void \****auditdata***, security\_class\_t** *cls***,** **char \****msgbuf***, size\_t** *msgbufsize***);**

  This callback is used for supplemental auditing in AVC messages.  The *auditdata* and *cls* arguments are the values passed to [**avc\_has\_perm**(3)](/avc_has_perm/3.md). A human-readable interpretation should be printed to *msgbuf* using no more than *msgbufsize* characters.

- **SELINUX\_CB\_VALIDATE**

  **int (\****func\_validate***) (char \*\****ctx***);**

  This callback is used for context validation.  The callback may optionally modify the input context by setting the target of the  *ctx* pointer to a new context.  In this case, the old value should be freed with [**freecon**(3)](/freecon/3.md). The value of *errno* should be set to **EINVAL** to indicate an invalid context.

- **SELINUX\_CB\_SETENFORCE**

  **int (\****func\_setenforce***) (int** *enforcing***);**

  This callback is invoked when the system enforcing state changes. The *enforcing* argument indicates the new value and is set to *1* for enforcing mode, and *0* for permissive mode.

- **SELINUX\_CB\_POLICYLOAD**

  **int (\****func\_policyload***) (int** *seqno***);**

  This callback is invoked when the system security policy is reloaded. The *seqno* argument is the current sequential number of the policy generation in the system.

## RETURN VALUE

None.

## ERRORS

None.

## AUTHOR

Eamon Walsh \<ewalsh@tycho.nsa.gov\>

## SEE ALSO

[**selabel\_open**(3)](/selabel_open/3.md), [**avc\_init**(3)](/avc_init/3.md), [**avc\_netlink\_open**(3)](/avc_netlink_open/3.md), [**selinux**(8)](/selinux/8.md)