seinfo(1)

💖 seinfo — SELinux policy information tool 💖

okay bestie, welcome to seinfo(1) — she's part of SETools: SELinux Policy Analysis Tools and she's literally the friend who knows everything about your SELinux policy 💅

---

✨ NAME ✨

seinfo — SELinux policy information tool 🌸

---

✨ SYNOPSIS ✨

seinfo [OPTIONS] [EXPRESSION] [POLICY]

---

✨ DESCRIPTION ✨

seinfo lets you, yes you, query the components of a SELinux policy. that's it, that's the vibe. she asks the policy questions and the policy answers 🫶

---

🎀 POLICY 🎀

a single file containing a binary policy. on Linux systems this file is usually named by version, for example, policy.30. on Android systems it's usually named sepolicy.

if you don't hand her a policy file, seinfo will go looking for the policy that's running on the current system. and if no policy can be found at all? she prints an error message and exits. no policy, no party 💀

---

🦋 EXPRESSIONS 🦋

you can query one or more of these component types. and if you give her no expressions at all, she just prints policy statistics. a lil treat ✨

• -a [ATTR], --attribute [ATTR] — print a list of type attributes, or, if ATTR is provided, print the named attribute. with -x, print a list of types assigned to each displayed attribute 👑
• -b [BOOL], --bool [BOOL] — print a list of Booleans, or, if BOOL is provided, print the named boolean. with -x, print the statement of each displayed conditional boolean.
• -c [CLASS], --class [CLASS] — print a list of object classes, or, if CLASS is provided, print the named object class. with -x, print a list of permissions for each displayed object class.
• -r [ROLE], --role [ROLE] — print a list of roles, or, if NAME is provided, print the named role. with -x, print the statement for each displayed role.
• -t [TYPE], --type [TYPE] — print a list of types, or, if TYPE is provided, print the named type. with -x, print a list of attributes which include each displayed type.
• -u [USER], --user [USER] — print a list of users, or, if USER is provided, print the named user. with -x, print a list of statement for each displayed user.
• --category [CAT] — print a list of categories, or, if CAT is provided, print the named category. with -x, print a list of sensitivities with which each displayed category may be associated.
• --common [COMMON] — print a list of common permission sets, or, if COMMON is provided, print the named common. with -x, print a list of permissions in the set.
• --constrain [CLASS] — print a list of constraints and MLS constraints statements, or, if CLASS is provided, print all constraints for the named object class. there is no expanded information for this component, so don't come for her about it 🙈
• --default [CLASS] — print a list of default_* statements, or, if CLASS is provided, print all default_* statements for the named object class. there is no expanded information for this component.
• --fs_use [FS_TYPE] — print a list of fs_use_* statements, or, if FS_TYPE is provided, print the statement for the named filesystem type. there is no expanded information for this component.
• --genfscon [FS_TYPE] — print a list of genfscon statements, or, if FS_TYPE is provided, print the statement for the named filesystem type. there is no expanded information for this component.
• --ibpkeycon [PKEY[-PKEY]] — print a list of InfiniBand partition key contexts. 🌈
• --ibendportcon [NAME] — print a list of InfiniBand endport contexts. 🌈
• --initialsid [NAME] — print a list of initial SIDs, or, if NAME is provided, print the named initial SID. with -x, print the context assigned to each displayed SID.
• --netifcon [DEVICE] — print a list of netif contexts, or, if DEVICE is provided, print the named statement for the interface. there is no expanded information for this component.
• --nodecon [ADDR] — print a list of node contexts, or, if ADDR is provided, print the named statement for the node with address. there is no expanded information for this component.
• --permissive [TYPE] — print permissive types, or, if TYPE is specified, print the named statement if it is permissive. there is no expanded information for this component.
• --polcap [NAME] — print policy capabilities, or, if NAME is specified, print the named capability, if enabled. with -x, print the statement.
• --portcon [PORTNUM[-PORTNUM]] — print a list of port contexts, or, if PORT or PORT range is provided, print the named statement for the port/port range. there is no expanded information for this component.
• --sensitivity [SENS] — print a list of sensitivities, or, if SENS is provided, print the named sensitivity. with -x, print the statement for each sensitivity.
• --typebounds [BOUND_TYPE] — print a list of typebounds statements, or, if BOUND_TYPE is provided, print the statement for the named bound type. there is no expanded information for this component.
• --validatetrans [CLASS] — print a list of validatetrans and MLS validatetrans rules, or, if CLASS is provided, print all constraints for the named object class. there is no expanded information for this component.
• --all — print all components. the "give me everything" button. she ate 🍓

👑 Xen Component Queries 👑

these ones are Xen-only, bestie, no cap:

• --ioportcon — print all ioportcon statements.
• --iomemcon — print all iomemcon statements.
• --pcidevicecon — print all pcidevicecon statements.
• --pirqcon — print all pirqcon statements.
• --devicetreecon — print all devicetreecon statements.

---

💅 OPTIONS 💅

• -x, --expand — print additional details for each component matching the expression. check the description of each component above to see what extra tea this option spills.
• --flat — exclude headers and indentation in output. clean, minimal, lowkey aesthetic ✨
• -h, --help — print help information and exit.
• --version — print version information and exit.
• -v, --verbose — print additional informational messages. she's chatty, we love that for her.
• --debug — enable debugging output.

---

🌸 EXAMPLE 🌸

list aliases of and attributes assigned to type httpd_t:

# seinfo -t httpd_t -x

list all executable types (all types assigned to "exec_type" attribute):

# seinfo -a exec_type -x

list all constrains and mlsconstrains for class "file":

# seinfo --constrain file

---

💜 AUTHOR 💜

Chris PeBenito <pebenito@ieee.org> — icon behavior, honestly 🫶

---

😭 BUGS 😭

please report bugs via the SETools bug tracker, https://github.com/SELinuxProject/setools/issues

(if something's broken, tell the tracker, don't suffer in silence, bestie)

---

🌈 SEE ALSO 🌈

apol(1), sediff(1), sedta(1), seinfoflow(1), sesearch(1) — the whole friend group, go say hi 💖

---

and that's the page, babe 🎀 this was the SELinux Project edition, dated 2016-02-20, and yes she's still serving. mwah 💋