sesearch(1)

✨ sesearch — the SELinux policy query tool, but make it a group chat 💅

okay so bestie, this is sesearch, and it lives in the SETools: SELinux Policy Analysis Tools collection (it's a section 1 manual page, if you're keeping track 🎀). It's basically the search bar for SELinux policy rules, and it ate. Let's get into it.

---

🌸 SYNOPSIS 🌸

sesearch [OPTIONS] [OPTIONS] [EXPRESSION] [POLICY]

(yes the [OPTIONS] shows up twice, no that's not a typo, that's just how she is 💅)

---

🦋 DESCRIPTION 🦋

sesearch lets you search the rules inside a SELinux policy. That's the whole vibe. You have a policy, you have questions, she has answers. Periodt.

---

👑 POLICY 👑

So the policy argument is a single file containing a binary policy. On Linux systems it's usually named by version, like, for example, policy.30 ✨. On Android systems it's usually named sepolicy 🌈.

If you don't hand her a policy file, sesearch will go looking for the policy running on the current system — she'll find it herself, she's resourceful like that. And if no policy can be found at all? She prints an error message and exits. No drama, just receipts. 😭

---

🧚 EXPRESSIONS 🧚

You can throw her an expression with values for a given field (or fields) in a rule. And here's the iconic part: if no expression is specified, or if none of the fields you gave apply to a given rule type, then all rules of that type are considered to match the expression. So like, no filter = match everything. She's generous. 🫶

💖 Type Enforcement Rule Types 💖

• -A — find allow and allowxperm rules.
• --allow — find allow rules.
• --auditallow — find auditallow rules.
• --dontaudit — find dontaudit rules.
• --allowxperm — find allowxperm rules.
• --auditallowxperm — find auditallowxperm rules.
• --dontauditxperm — find dontauditxperm rules.
• -T, --type_transition — find type_transition rules.
• --type_member — find type_member rules.
• --type_change — find type_change rules.

🌈 RBAC Rule Types 🌈

• --role_allow — find role allow rules.
• --role_transition — find role_transition rules.

⚠️ note bestie: TE/MLS rule searches cannot be mixed with RBAC rule searches. They do NOT sit together at lunch. 🙈

⭐ MLS Rule Types ⭐

• --range_transition — find range_transition rules.

🎀 Rule Fields 🎀

• -s NAME, --source NAME — find rules where NAME is the source type/role.
• -t NAME, --target NAME — find rules where NAME is the target type/role.
• -D NAME, --default NAME — find rules where NAME is the default type/role/level.
• -c NAME, --class NAME — find rules where NAME is the object class.
• -p P1[,P2,...] --perm P1[,P2...] — find rules that have at least one of the permissions you listed. Multiple permissions? Comma-separated list, babe. 💅
• -b BOOL[,B2,...], --bool BOOL[,B2,...] — find conditional rules that have the named Boolean chillin' in their conditional expression. Multiple Booleans = comma-separated list. And heads up: this option includes rules in both the true and false lists of the conditional. She does not pick sides. 👑

🔥 Search Options 🔥

These extra options change up how the search goes down. Obsessed.

• -ds — a matching rule has to have the specified source attribute/type/role explicitly, instead of matching by attribute contents.
• -dt — a matching rule has to have the specified target attribute/type/role explicitly, instead of matching by attribute contents.
• -eb — a matching rule has to have all the specified Booleans, instead of matching any of the specified Boolean.
• -ep — a matching rule has to have exactly the specified permissions, instead of matching any of the specified permission.
• -ex — a matching rule has to have exactly the specified extended permissions, instead of matching any listed extended permission.
• -Sp — a matching rule has to have permissions that are a superset of the specified permissions, instead of matching any of the permissions.
• -rs — use a regular expression for matching the source type/role.
• -rt — use a regular expression for matching the target type/role.
• -rc — use a regular expression for matching the object class.
• -rd — use a regular expression for matching the default type/role.
• -rb — use a regular expression for matching Booleans.

---

💜 OPTIONS 💜

• -h, --help — print help information and exit. (she'll tell you about herself, go ahead, ask 🫶)
• --version — print version information and exit.
• -v, --verbose — print additional informational messages. Chatty era. 🗣️
• --debug — enable debugging output. For when you need the lore. 🔍

---

🍓 EXAMPLE 🍓

List allow (and allowxperm) rules for accessing files labeled container_file_t from domains with attribute container_domain:

# sesearch -A -s container_domain -t container_file_t -c file

List allow and dontaudit rules for accessing chr_files labeled container_file_t, that are controlled by boolean container_use_devices:

# sesearch -A --dontaudit -t container_file_t -c chr_file -b container_use_devices

List dontaudit rules assigned via application_domain_type attribute (rules concerning specific types with that attribute are excluded):

# sesearch --dontaudit -s application_domain_type -ds

---

💌 AUTHOR 💌

Chris PeBenito <pebenito@ieee.org> — the icon, the moment, the main character. 👑

---

💀 BUGS 💀

Found something broken? Please report bugs via the SETools bug tracker: https://github.com/SELinuxProject/setools/issues — she wants to hear it, fr fr. 🐛

---

🌟 SEE ALSO 🌟

apol(1), sediff(1), sedta(1), seinfo(1), seinfoflow(1) — the whole friend group, go say hi. ✨

---

SELinux Project 🦋 2016-02-20 🎀 — that's the source, the version-of-record date, and the manual name <rainbow>sesearch(1)</rainbow>, mwah, signing off bestie 💖