sedta(1)

💅 sedta — the SELinux domain transition girlie 💅

okay bestie, so this is sedta(1), part of the SETools: SELinux Policy Analysis Tools fam. she's a command line tool, she does domain transition analysis on SELinux policies, and honestly? she eats. let's get into it 🦋

---

✨ SYNOPSIS ✨

sedta [OPTIONS] -s SOURCE [-t TARGET (-S|-A LIMIT)] [EXCLUDE [EXCLUDE ...]]

that's the whole vibe. source, maybe a target, maybe an algorithm, maybe some types to exclude. simple. iconic. 💖

---

🌸 DESCRIPTION 🌸

so like, sedta is a command line tool that lets you do domain transition analyses on an SELinux policy. that's it, that's the job, and she does it flawlessly. no notes. ✨

---

🎀 POLICY 🎀

so the policy is a single file containing a binary policy, mmkay?

• on Linux systems this file is usually named by version, for example policy.30
• on Android systems this file is usually named sepolicy

and if you don't hand her a policy file? no worries, she'll go searching for the policy that's running on your current system. 🕵️♀️ and if she can't find any policy at all? she will print an error message and exit, periodt. 💀

---

👑 OPTIONS 👑

🔍 Analysis Settings

• -p POLICY — specify the policy to analyze. if you don't specify one, sedta will search for the policy running on your current system. same energy as the POLICY section, just in flag form. 🫶
• -s SOURCE — specify the source type to use in the domain transition analysis. this one's kinda required, she needs to know where the story starts. 💜
• -t TARGET — specify the target type to use in the domain transition analysis. heads up bestie: using this option will also require specifying an analysis algorithm. no algorithm, no vibes. ⭐

🧚 Analysis Algorithms

okay so sedta uses graph algorithms to analyze the domain transition paths of an SELinux policy. the following algorithms are the options for figuring out paths from a source type to a target type:

• -S — print the shortest domain transition path(s) from the source type to the target type. and if multiple paths have the same length? she shows all of them, because fairness. 💅
• -A LIMIT — print all domain transition path(s) up to LIMIT steps long. 🚨 and depending on how connected your policy is, this may be extremely expensive. like, she will be working. be warned. 😭

🌈 Analysis Options

• -r — perform a reverse domain transition analysis. the domain transitions get analyzed to find the parent domains instead of finding the child domains. backwards but make it fashion. 🙈
• -l LIMIT_TRANS — specify the maximum number of domain transitions to output. the default is unlimited. yes, unlimited. go off. 🔥
• -o OUTPUT_PATH — generate a graphical representation of the analysis in PNG format at the specified path. art. literally art. 🎨
• EXCLUDE — a space-separated list of types to exclude from the analysis. bye girl, not you. ✌️

🍓 General Options

• --full — print rule lists for transitions.
• --stats — print domain transition graph statistics at the end of the analysis. numbers at the end, cute lil finale. 📊
• -h, --help — print help information and exit.
• --version — print version information and exit.
• -v, --verbose — print additional informational messages. she talks more. we love that for her. 💬
• --debug — enable debugging output. for when things are giving bug and you need the receipts. 🐛

---

⭐ EXAMPLE ⭐

show the shortest transition paths from httpd_t to unconfined_t, while not using container_runtime_t:

# sedta -s httpd_t -t unconfined_t -S container_runtime_t

list all domain transition paths shorter than 3 steps from init_t to smbd_t:

# sedta -s init_t -t smbd_t -A 3

see? easy. slay. 🔥

---

💖 AUTHOR 💖

Chris PeBenito <pebenito@ieee.org> — the icon, the moment, the legend. 👑

---

🐛 BUGS 🐛

please report bugs via the SETools bug tracker, https://github.com/SELinuxProject/setools/issues — she wants to know, fr fr. don't be shy. 💌

---

👀 SEE ALSO 👀

apol(1), sediff(1), seinfo(1), seinfoflow(1), sesearch(1) — the whole friend group, go say hi. 🫶

---

okay that's the whole page bestie, ty for coming to my TED talk 💅✨

this one's brought to you by the SELinux Project, dated 2016-02-20 — and yeah the man page says sedta(1) at the bottom too, because consistency is the blueprint. 🎀 mwah, bye! 🦋