seinfoflow(1)

💖 seinfoflow — the info-flow girlies' bestie 💖

ok so bestie, you found it: seinfoflow(1), a SETools: SELinux Policy Analysis Tools situation. buckle up, we're doing information flow analysis on SELinux policies and it's gonna be ✨illuminating✨

🦋 SYNOPSIS 🦋

seinfoflow [OPTIONS] -m MAP -s SOURCE [-t TARGET (-S|-A LIMIT)] [EXCLUDE
[EXCLUDE ...]]

that's the whole vibe. -m and -s are the mandatory girlies, everything else is optional but iconic.

---

🌸 DESCRIPTION 🌸

seinfoflow is a command line tool, and what it does is let you (yes you, gorgeous) perform information flow analyses on an SELinux policy. that's it, that's the whole job. lowkey powerful, no cap. 💅

👑 POLICY 👑

so the policy is a single file containing a binary policy. on Linux systems this file is usually named by version, for example policy.30 — so cute, so numbered. on Android systems this same file is usually named sepolicy. if you don't give it a policy file, seinfoflow will go search for the policy running on the current system, main character detective energy. and if it can't find any policy at all? it prints an error message and exits. no policy, no party. 😭

🎀 PERMISSION MAP 🎀

this is a file containing mappings of object permissions for object classes. these mappings are the basis on how to compute the infoflow between types — like, they're literally the foundation, fr fr. on Debian, a standard permission map can be found when the package python3-sepolgen is installed, at /var/lib/sepolgen/perm_map. noted. screenshotting. 📸

---

✨ OPTIONS ✨

🧚 Analysis Settings

• -p POLICY — specify the policy to analyze. if none is specified, seinfoflow will search for the policy running on the current system, because she's resourceful like that.
• -m MAP — specify the path to the permission map file to use in the information flow analysis. required, bestie, don't forget her.
• -s SOURCE — specify the source type to use in the information flow analysis. also required. the origin story.
• -t TARGET — specify the target type to use in the information flow analysis. heads up though: using this option will also require specifying an analysis algorithm. so don't come with -t and no algorithm, she will not accept that. 🙅

🔥 Analysis Algorithms

seinfoflow uses graph algorithms to analyze the information flow paths of an SELinux policy. the following algorithms are options for determining paths from a source type to a target type:

• -S — print the shortest information flow path(s) from the source type to the target type. and if multiple paths have the same length? all will be displayed. everyone gets a turn, we don't gatekeep. 💖
• -A LIMIT — print all information flow path(s) up to LIMIT steps long. > ⚠️ depending on the connectiveness of the policy, a limit of 5 or more may be extremely expensive. like, your terminal will be sweating. be careful out there.

💜 Analysis Options

• -w MIN_WEIGHT — specify the minimum permission weight to consider for the analysis (1-10). the default is 3.
• -l LIMIT_FLOWS — specify the maximum number of information flows to output. the default is unlimited, so she'll yap forever unless you set a limit.
• -o OUTPUT_PATH — generate a graphical representation of the analysis in PNG format at the specified path. pretty picture!! 🌈
• -b <boolname>:true[,<boolname2>:false,...] — specify boolean values to use in the analysis. multiple booleans can be specified, separated by commas. alternatively, this option can be set with the special value -b default to use the default boolean values from the policy. and if this option is not specified at all, the analysis will include all possible infomation flows, including both "if" and "else" branches of boolean expressions. (yes, "infomation" — that's how the original spells it and I am not fixing her typo, I respect her too much. 💀)
• EXCLUDE — a space-separated list of types to exclude from the analysis. get them out of here. 🫶

⭐ General Options

• -r, --reverse — display information flows into the source type. no effect if a target type is specified, so don't bother, it just won't do anything.
• --stats — print information flow graph statistics at the end of the analysis. numbers!! we love a little data moment.
• -h, --help — print help information and exit.
• --full — print full rule lists for information flows. no truncation, we're reading the whole thing.
• --version — print version information and exit.
• -v, --verbose — print additional informational messages. she's chatty and we support her.
• --debug — enable debugging output. for when you need to see everything. 🔍

---

💀 EXAMPLE 💀

show the shortest paths for process running as httpd_t to access user home files, using the default permission map:

# seinfoflow -s httpd_t -t user_home_t -S

list all data paths shorter than 3 steps from smbd_t to httpd_log_t, when samba_enable_home_dirs and samba_create_home_dirs booleans are enabled:

# seinfoflow -s smbd_t -t user_home_t -A 3 -b "samba_enable_home_dirs:true,samba_create_home_dirs:true"

ate. periodt. 💅

---

🌷 AUTHOR 🌷

Chris PeBenito <pebenito@ieee.org> — the legend herself. bow down. 👑

🙈 BUGS 🙈

please report bugs via the SETools bug tracker, https://github.com/SELinuxProject/setools/issues. she wants to know. she's listening. 🐛

💜 SEE ALSO 💜

apol(1), sediff(1), sedta(1), seinfo(1), sesearch(1) — the whole friend group, go say hi.

---

and that's the page, bestie — brought to you by the SELinux Project, dated 2016-02-20, page seinfoflow(1). go analyze some information flow, you gorgeous genius. mwah. 💋✨