sechecker(1)

📦
version 4.7.1 · 3 versions
, in centos-stream 10, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 sechecker(1) — automated SELinux policy analysis, but make it a whole moment 💖

okay so bestie, welcome to sechecker, one of the SETools girlies (yes, from the SELinux Policy Analysis Tools crew ✨). Basically: you hand it a config file, it runs your checks, it tells you what's up. Lowkey iconic. 🎀

✨ SYNOPSIS ✨

sechecker [OPTIONS] config.ini [POLICY]

🌸 DESCRIPTION 🌸

sechecker is your automated SELinux policy analysis bestie. It reads a configuration file that defines one or more analysis checks, and then it just… runs them. No cap. 💅

📁 POLICY 📁

This is a single file containing a binary policy. On Linux systems it's usually named by version, like policy.30 — very demure. On Android systems it's usually named sepolicy — very Android of it.

If you don't give it one, sechecker will try to locate and open the current policy that's running on the system. It'll go find it itself, main character energy fr fr. 🦋

👑 OPTIONS 👑

  • -o <path> — Send the results to the path you specify instead of to stdout. You want it in a file? Say less. 💾
  • -h, --help — Prints the help info and dips. 👋
  • --version — Prints version info and dips. 🏷️
  • -v, --verbose — Prints extra informational messages, for when you simply must know everything. 🗣️
  • --debug — Turns on debugging output. For the girlies who need to see the receipts. 🔍

🚦 RETURN CODES 🚦

sechecker hands back these return codes:

  • 0 — All checks passed. Slay. ✨
  • 1 — One or more checks failed. Oof. 😭
  • 2 — There's an error in the configuration file. 💀
  • 3 — Other errors, like a policy open error. 🙈

📝 CONFIGURATION FILE 📝

The config file is in .ini format. Every section counts as a check, and the section name is the name of the check. So you literally name your own checks, periodt.

All checks support these options:

  • check_type = <name> — This picks the type of test used in this check. It's required, bestie. No check_type, no check. 🚨
  • desc = <text> — Optional text field. If you set it, the contents get printed in the output. Usually you use it to explain what the check is actually for. Very helpful, very thoughtful. 💖
  • disable = <text> — Optional text field. If it's set, the check won't run, and your text gets added to the report to explain why it wasn't run. It's the "sorry bestie, not today" button. 🛑

🔥 TYPE ENFORCEMENT ALLOW RULE ASSERTION 🔥

This one checks for the nonexistence of type enforcement allow rules. Its check_type is assert_te.

Here's how it moves: it runs the query, and any unexpected results from that query — after removing any exempted sources or targets — get listed as failures. Any expected results that never show up also get listed as failures. If a rule has an empty attribute, rendering it useless, it's ignored. But if a rule has an attribute, it's considered a failure unless all of the member types are exempted. All of them. Every single one. 💀

Criteria options

  • source = <type or type attribute> — The source type/attribute criteria for the query.
  • target = <type or type attribute> — The target type/attribute criteria for the query.
  • tclass = <type or type attribute>[ ....] — A space-separated list of object class criteria for the query.
  • perms = <type or type attribute>[ ....] — A space-separated list of permissions for the query.
At least one of the above options must be set in this check. Non-negotiable. 💅

Additional Options

  • expect_source = <type or type attribute>[ ....] — A space-separated list of types and type attributes. Each of these types must be seen as the source of a rule that matches the criteria. At the end of the query, every unseen type in this list gets reported as a failure. This is optional.
  • expect_target = <type or type attribute>[ ....] — A space-separated list of types and type attributes. Each of these types must be seen as the target of a rule that matches the criteria. At the end of the query, every unseen type in this list gets reported as a failure. This is optional.
  • exempt_source = <type or type attribute>[ ....] — A space-separated list of types and type attributes. Rules with these as the source get ignored. This is optional.
  • exempt_target = <type or type attribute>[ ....] — A space-separated list of types and type attributes. Rules with these as the target get ignored. This is optional.
Note: If a rule has an attribute source, all of the member types must be in the expect_source list or the exempt_source list to pass. Similarly, if a rule has an attribute target, all of the member types must be in the expect_target list or the exempt_target list to pass. Yes, all. We said what we said. 🫶

🎭 ROLE BASED ACCESS CONTROL ALLOW RULE ASSERTION 🎭

This one checks for the nonexistence of role based access control (RBAC) allow rules. Its check_type is assert_rbac.

Same deal as above: it runs the query, and any unexpected results — after removing exempted sources or targets — get listed as failures. Any expected results that aren't seen also get listed as failures. 😤

Criteria options

  • source = <role — The source role criteria for the query.
  • target = <role> — The target role criteria for the query.
At least one of the above options must be set in this check.

Additional Options

  • expect_source = <role>[ ....] — A space-separated list of roles. Each of these roles must be seen as the source of a rule that matches the criteria. At the end of the query, every unseen role in this list gets reported as a failure. This is optional.
  • expect_target = <role>[ ....] — A space-separated list of roles. Each of these roles must be seen as the target of a rule that matches the criteria. At the end of the query, every unseen role in this list gets reported as a failure. This is optional.
  • exempt_source = <role>[ ....] — A space-separated list of roles. Rules with these as the source get ignored. This is optional.
  • exempt_target = <role>[ ....] — A space-separated list of roles. Rules with these as the target get ignored. This is optional.

🫧 EMPTY TYPE ATTRIBUTE ASSERTION 🫧

This one checks that the attribute you named is empty. You can optionally make it also pass if the attribute doesn't exist at all. Its check_type is empty_typeattr.

Options

  • attr = <type attribute> — The type attribute to check. This is required.
  • missing_ok = <type attribute> — Consider the check passing if the attribute does not exist. This is optional. Default is false.

🧚 READ-ONLY EXECUTABLES ASSERTION 🧚

This one checks that all file types that are executable are read-only. Its check_type is ro_execs.

Options

  • exempt_file = <type or type attribute>[ ....] — A space-separated list of types and type attributes. These will not be considered executable. This is optional.
  • exempt_exec_domain = <type or type attribute>[ ....] — A space-separated list of types and type attributes. Rules with these as the source get ignored if they allow file execute permission. This is optional.
  • exempt_write_domain = <type or type attribute>[ ....] — A space-separated list of types and type attributes. Rules with these as the source get ignored if they allow file write or append permissions on types determined executable. This is optional.

🐚 READ-ONLY KERNEL MODULES ASSERTION 🐚

This one checks that all file types that are for kernel modules are read-only. Its check_type is ro_kmods.

Options

  • exempt_file = <type or type attribute>[ ....] — A space-separated list of types and type attributes. These will not be considered kernel modules. This is optional.
  • exempt_load_domain = <type or type attribute>[ ....] — A space-separated list of types and type attributes. Rules with these as the source get ignored if they allow kernel module loading permission. This is optional.
  • exempt_write_domain = <type or type attribute>[ ....] — A space-separated list of types and type attributes. Rules with these as the source get ignored if they allow file write or append permissions on types determined to be kernel modules. This is optional.

🌈 CONFIGURATION EXAMPLES 🌈

Example 1. A check called "no_unconfined" that will determine if the domain_unconfined_type attribute is empty or missing.

[no_unconfined]
check_type = empty_typeattr
desc = Verify that the domain_unconfined_type attribute is missing or empty.
attr = domain_unconfined_type
missing_ok = True

Example 2. A check called "ro_execs" that will determine if all executable types are read-only.

[ro_execs]
check_type = ro_execs
desc = Verify that the all executables and libraries are read-only.

Example 3. A check called "execheap" that will determine that there are no domains with the execheap permission except for unconfined_execheap_t.

[execheap]
check_type = assert_te
desc = Verify no domains have executable heap.
tclass = process
perms = execheap
exempt_source = unconfined_execheap_t

💜 AUTHOR 💜

Chris PeBenito <chpebeni@linux.microsoft.com> — the icon who made this. 👑

🐛 BUGS 🐛

Please report bugs via the SETools bug tracker: https://github.com/SELinuxProject/setools/issues. Found a bug? Tell the tracker, bestie, not the group chat. 🫶

👀 SEE ALSO 👀

apol(1), sediff(1), sedta(1), seinfo(1), seinfoflow(1), sesearch(1)

okay and that's the whole page 💖 big thank you to the SELinux Project, this manual page is dated 2020-06-09, and it's living in the SETools: SELinux Policy Analysis Tools collection. go run your checks, bestie, and remember: all checks passed is the only acceptable vibe. periodt. ✨🎀🦋

📦 where this page comes from