segraph_query(1)

💅 segraph_query — the SELinux policy analysis tool bestie you didn't know you needed

okay so real talk, this is segraph_query(1), and it lives in the SELinux Policy Analysis Tool family. it's a little command-line cutie that reads your policy graph and answers questions about it. no cap, it's giving detective energy 🔍✨

---

✨ NAME ✨

segraph_query — SELinux policy analysis tool

---

🌸 SYNOPSIS 🌸

segraph_query [-h] [-d POLICY_GRAPH2] POLICY_GRAPH QUERY_FUNCTIONS

---

🦋 DESCRIPTION 🦋

so basically it analyses a policy graph using whatever query functions you hand it. you give it a graph, you give it questions, it gives you answers. main character energy fr fr 💖

the query functions available rn:

• write_executable — finds all types that correspond to executables and that can be written to. it lists a dictionary where the executable types are the keys and the types with write permission are the values. so like, "who can scribble on which binary" vibes 😭
• transition_write — finds domain transitions via entrypoints that the source domain can rewrite. and the way that this effectively increases the reach of the source domain by the access rights of the target domain?? iconic. it lists triplets of (source domain, target domain, entrypoint)
• write_to_security — finds domains that are allowed write access to "security related" types. it lists the domains with that specified write access, plus lists of the affected types (the security types that can be written to). lowkey important, highkey scary 💀

---

✨ OPTIONS ✨

📍 Positional arguments

• POLICY_GRAPH — the policy graph file. the whole reason we're here 🫶
• QUERY_FUNCTIONS — a comma separated list of the query functions you want executed. yes, comma separated, not space separated, don't do it to yourself 🙈

🎀 Optional arguments

• -h, --help — show the help message and dip out. classic ✨
• -d POLICY_GRAPH2, --diff POLICY_GRAPH2 — another policy graph file, but this one's for comparison. bring a friend so the tool can compare them 👑

---

💜 EXAMPLE 💜

check a policy graph (one you made using sebuild_graph) with the write_executable function:

$ graph_query.py graph write_executable

show the consequences of a change in policy (where graph2 was created after the change):

$ segraph_query graph2 write_executable,transition_write,write_to_security -d graph

👀 psst — the first example literally says graph_query.py, so keep it exactly like that when you run it. i don't make the rules, i just vibe with them.

---

🌈 SEE ALSO 🌈

sebuild_graph(1) — go make a graph first, bestie, you can't query what doesn't exist 💅

---

👑 AUTHOR 👑

Vit Mojzis <vmojzis@redhat.com>

---

and that's the whole page, periodt. this version came from the SELinux Policy Analysis Tool source, dated 2017-02-09, and it's segraph_query(1) through and through. slay, stay safe, and never write to your security types without thinking twice 🎀✨🦋