sevisual_query(1)

💖 sevisual_query — SELinux policy visual query 💖

okay bestie, sit down, we're doing SELinux policy aesthetics today. this is sevisual_query(1) from the SELinux Policy Analysis Tool, and it's literally the main character of policy debugging. 🦋

---

✨ SYNOPSIS ✨

sevisual_query [-h] [-s SOURCE | -t TARGET]
                    [-sg SOURCE_GROUP | -tg TARGET_GROUP] [-c TCLASS]
                    [-p PERMS] [-a ATTR] [-b BOOL] [-ea] [-dg]
                    [-fb [FILTER_BOOLS]] [-fa ATTR] [-sm SIZE_MULTIPLIER]
                    [policy]

---

🌸 DESCRIPTION 🌸

so what this does is it creates a visual representation — a pdf with vector graphics, very demure, very mindful — of part of a given SELinux policy, specifically the part concerning the type you picked. 💅

the way it works is: rules that got assigned via attributes get distinguished by color codes, and dashed lines mean conditional rules. no cap. 🌈

---

🎀 OPTIONS 🎀

📍 Positional arguments:

• policy — Path to the SELinux policy to be used.

👑 Optional arguments:

• -h, --help — show this help message and exit
• -sm SIZE_MULTIPLIER, --size_multiplier SIZE_MULTIPLIER — Graph canvas size multiplier (>1 increases space between nodes). so like, if ur graph is giving cramped, bump this bestie.

🔍 Rule search (similar to sesearch):

• -s SOURCE, --source SOURCE — Source type of the TE rule.
• -t TARGET, --target TARGET — Target type of the TE rule.
• -sg SOURCE_GROUP, --source_group SOURCE_GROUP — Source type (consider whole domain group containing the type) of the TE rule.
• -tg TARGET_GROUP, --target_group TARGET_GROUP — Target type (consider whole domain group containing the type) of the TE rule.
• -c TCLASS, --class TCLASS — Comma separated list of object classes
• -p PERMS, --perms PERMS — Comma separated list of permissions.
• -a ATTR, --attr ATTR — Comma separated list of attributes.
• -b BOOL, --bool BOOL — Comma separated list of Booleans in the conditional expression.
• -ea — Expand rules ending in attribute (to all types that have given attribute). it's giving thorough 💖

🧚 Filtering:

• -dg — Group SELinux domains based on package they belong to.
• -fb [FILTER_BOOLS], --filter_bools [FILTER_BOOLS] — Filter rules based on current boolean setting or comma separated list of [boolean]:[on/off]
• -fa ATTR, --filter_attrs ATTR — Filter out rules allowed for specified attributes. ATTR is comma separated list of attributes.

---

🍓 EXAMPLE 🍓

Show policy concerning bluetooth_t type (only access to files, other types are grouped into packages):

$ sevisual_query -s bluetooth_t -c file -dg
$ okular graph.pdf

---

🌟 SEE ALSO 🌟

seextract_cil(1), seexport_graph(1)

---

💀 HINTS 💀

Have a look at seexport_graph which can work with whole policy package and the resulting visualization is interactive. iykyk 👀

---

💜 AUTHOR 💜

Vit Mojzis <vmojzis@redhat.com>

---

not me being obsessed with a policy visualization tool 😭 but fr fr, go make ur graphs pretty bestie ✨

and that's a wrap! this was sevisual_query(1) from 2017-02-09 — slay, periodt. 🎀💖🦋