seexport_graph(1)

💅 seexport_graph — SELinux Policy Analysis Tool, bestie edition

okay so picture this: it's a seexport_graph(1) situation and you need to pull a slice of an SELinux policy out into a graphml file. That's the whole vibe. Manual section 1, SELinux Policy Analysis Tool, and she's here to help. 🦋

---

✨ NAME ✨

seexport_graph — the SELinux policy graph export tool. she exports, she graphs, she slays. 💖

---

🌸 SYNOPSIS 🌸

seexport_graph [-h] [-c TCLASS] [-p PERMS] [-a ATTR] [-b BOOL] [-ea]
               [-fb [FILTER_BOOLS]] [-fa ATTR]
               package [policy]

---

🎀 DESCRIPTION 🎀

So basically? This tool takes part of a given SELinux policy (specifically the part concerning the selected package) and exports it into a graphml file. And then you can go absolutely feral visualizing that file — like, for example, using Gephi (gephi.org). iconic behavior honestly. ✨

---

👑 OPTIONS 👑

🌈 Positional arguments

• package — the policy concerning this package is the one getting exported. that's the main character right there.
• policy — the path to the SELinux policy you want to use.

💜 Optional arguments

• -h, --help — show this help message and exit. the classic. the icon. the legend. 🫶

🔍 Rule search (similar to sesearch)

• -c TCLASS, --class TCLASS — a comma separated list of object classes
• -p PERMS, --perms PERMS — a comma separated list of permissions.
• -a ATTR, --attr ATTR — a comma separated list of attributes.
• -b BOOL, --bool BOOL — a comma separated list of Booleans in the conditional expression.
• -ea — expand rules ending in attribute (to all types that have the given attribute). go off, expand. 💅

🧚 Filtering

• -fb [FILTER_BOOLS], --filter_bools [FILTER_BOOLS] — filter rules based on the current boolean setting, or on a comma separated list of [boolean]:[on/off]
• -fa ATTR, --filter_attrs ATTR — filter out rules allowed for the specified attributes. ATTR is a comma separated list of attributes.

---

⭐ EXAMPLE ⭐

Say you wanna export the policy concerning the bluetooth daemon, only taking access to files and boolean settings into account (that's what the -fb is doing, bestie):

$ seexport_graph bluetooth -fb -c file,process

ate. no crumbs. 🔥

---

🦋 SEE ALSO 🦋

seextract_cil(1)

---

💀 BUGS 💀

ngl this one's a little unserious: domain_groups_cil.conf has to be kept up to date using the seextract_cil command. And lowkey? Only packages present there can be exported. so if your package isn't in that file, she simply will not show up. not her fault, it's the conf's fault. 😭

---

🍓 AUTHOR 🍓

Vit Mojzis <vmojzis@redhat.com>

---

okay that's the whole page, ily, go export some graphs 💖

this was brought to you by the SELinux Policy Analysis Tool, dated 2017-02-09, seexport_graph(1), periodt. 👑✨