Map SELinux requested permission to string representing System Call

Question

I am trying to map the requested access control vector to the corresponding textual representation of the system call in the following function:

int avc_has_perm(security_id_t ssid, security_id_t tsid,
         security_class_t tclass, access_vector_t requested,
         struct avc_entry_ref *aeref, void *auditdata)

From the documentation I can see that:

requested = requested permissions, interpreted based on @tclass

Is there a function that maps such requested field to the textual representation of the associated system call (i.e., read, write, open, etc.)?

Thanks

Answer 1

I found that the mapping is done at the kernel space by using the secclass_map[] structure declared inside the ./security/selinux/include/classmap.h.

A function that shows how to do the mapping is avc_dump_av inside ./security/selinux/avc.c