sediff(1)

💅 sediff — the SELinux policy difference tool (yes, that's the manual name, we're in sediff(1) bestie)

---

✨ NAME ✨

sediff — the SELinux policy difference tool. It's giving "spot the difference" but for policy files. 🔍

---

🌸 SYNOPSIS 🌸

sediff [OPTIONS] [EXPRESSION] POLICY1 POLICY2

---

🦋 DESCRIPTION 🦋

Okay so basically: sediff figures out the differences between two SELinux policies. That's it. That's the whole vibe. You hand it two policies, it tells you what changed. 💖

---

🎀 POLICY 🎀

A policy is a single file containing a binary policy, bestie. Keep that in mind:

• On Linux systems this file is usually named by version, for example, policy.30.
• On Android systems this file is usually named sepolicy.

🚨 And if you don't provide it? sediff will print an error message and exit. No policy, no party. 😭

---

🌈 EXPRESSIONS 🌈

You may specify an expression listing the policy elements to differentiate. If you don't provide one, then lowkey all supported policy elements get examined. All of them. Every single one. Iconic behavior fr fr. ✨

💜 Component Differences

• --common — find differences in common permission sets.
• -c, --class — find differences in object classes.
• -t, --type — find differences in attributes associated with types.
• -a, --attribute — find differences in types assigned to attributes.
• -r, --role — find differences in types authorized for roles.
• -u, --user — find differences in roles authorized for users.
• -b, --bool — find differences in the default values of booleans.
• --sensitivity — find differences in sensitivity definitions.
• --category — find differences in category definitions.
• --level — find differences in MLS level definitions.

🔥 Type Enforcement Rule Differences

• -A — find differences in allow and allowxperm rules.
• --allow — find differences in allow rules.
• --auditallow — find differences in auditallow rules.
• --dontaudit — find differences in dontaudit rules.
• --allowxperm — find differences in allowxperm rules.
• --auditallowxperm — find differences in auditallowxperm rules.
• --dontauditxperm — find differences in dontauditxperm rules.
• -T, --type_trans — find differences in type_transition rules.
• --type_member — find differences in type_member rules.
• --type_change — find differences in type_change rules.

👑 RBAC Rule Differences

• --role_allow — find differences in role allow rules.
• --role_trans — find differences in role_transition rules.

🌟 MLS Rule Differences

• --range_trans — find differences in range_transition rules.

🧚 Constraint Differences

• --constrain — find differences in constrain rules.
• --mlsconstrain — find differences in mlsconstrain rules.
• --validatetrans — find differences in validatetrans rules.
• --mlsvalidatetrans — find differences in mlsvalidatetrans rules.

🍓 Labeling Statement Differences

• --ibendportcon — find differences in ibendportcon (InfiniBand endport context) statements.
• --ibpkeycon — find differences in ibpkeycon (InfiniBand partition key context) statements.
• --initialsid — find differences in initial SID statements.
• --fs_use — find differences in fs_use_* statements.
• --genfscon — find differences in genfscon statements.
• --netifcon — find differences in netifcon statements.
• --nodecon — find differences in nodecon statements.
• --portcon — find differences in portcon statements.

⭐ Other Differences

• --default — find differences in default_* statements.
• --property — find differences in policy properties. Only applicable for binary policies (policy version, MLS enabled/disabled, unknown permissions setting).
• --polcap — find differences in policy capabilities.
• --typebounds — find differences in typebound statements.

---

💅 OPTIONS 💅

• -h, --help — print help information and exit. Your bestie when you're lost. 🫶
• --stats — print difference statistics only. Just the numbers, no yapping.
• --version — print version information and exit.
• -v, --verbose — print additional informational messages. For when you wanna know everything.
• --debug — enable debugging output. 🐛

---

🔍 DIFFERENCES 🔍

sediff categorizes differences in policy elements into one of three forms. Three. Not four. Here they are:

• added — the element exists only in the modified policy. Brand new, main character energy. ✨
• removed — the element exists only in the original policy. Gone. Left the group chat. 😭
• modified — the element exists in both policies but its semantic meaning has changed. For example, a class is modified if one or more permissions are added or removed. Same name, different person. 💀

---

🌸 EXAMPLE 🌸

Show differences in boolean settings:

# sediff -b /backup/policy.33 /etc/selinux/targeted/policy/policy.33

Show statistics for allow and allowxperm rule changes (how many rules where added, removed, or modified):

#sediff -A --stats /backup/policy.33 /etc/selinux/targeted/policy/policy.33

---

💖 AUTHOR 💖

Chris PeBenito <pebenito@ieee.org> — the icon, the moment, the legend. 👑

---

🙈 BUGS 🙈

Please report bugs via the SETools bug tracker, https://github.com/SELinuxProject/setools/issues. Not me being a bug reporter bestie, but do it, fr fr. 🐛

---

🦋 SEE ALSO 🦋

apol(1), sedta(1), seinfo(1), seinfoflow(1), sesearch(1) — the whole squad. Go read them, iykyk. 🌈

---

SELinux Project · 2016-04-19 — that's the source and the date bestie, and that's a wrap on sediff(1). Slay, go diff some policies. 💅✨