sealert(8)

🌸 sealert — the manual page, but make it cute 🌸

ok so bestie, this is the manual page for sealert, which lives in section 8 of the manual (you know, the admin/system tools girlies 💅). Pull up a chair, grab a strawberry 🍓, and let's get into it.

---

✨ NAME ✨

sealert — it's the setroubleshoot client tool, periodt.

---

🎀 SYNOPSIS 🎀

sealert [-b] [-f local_id] [-h] [-s] [-S] [-l id] [-a file] [-u] [-p]
[-P plugin_name]

---

🦋 DESCRIPTION 🦋

Okay so this manual page is literally describing the sealert program. No cap.

sealert is the user interface component — and by that I mean either GUI or command line, she contains multitudes 💖 — of the setroubleshoot system. And what does setroubleshoot do? She diagnoses SELinux denials and tries her very best to give you user friendly explanations for a SELinux denial (e.g. AVC, if you know you know) plus recommendations for how one might adjust the system to prevent the denial in the future. It's giving helpful. It's giving supportive bestie energy. 🫶

In a standard configuration, setroubleshoot is composed of two components: setroubleshootd and sealert. Dynamic duo. Main characters only. 👑

setroubleshootd is a system daemon which runs with root privileges and listens for audit events emitted from the kernel related to SELinux. ⚠️ The audit daemon must be running, okay, that's not optional. The audit daemon sends a dbus message to the setroubleshootd daemon when the system gets an SELinux AVC denial. Then setroubleshootd runs a series of analysis plugins which examines the audit data related to the AVC. It records the results of the analysis and signals any clients which have attached to the setroubleshootd daemon that a new alert has been seen. Like a group chat notification but for security events. 🔔

Now, sealert can be run in either a GUI mode or a command line mode. In both instances sealert run as a user process with the privileges associated with the user. (Yes bestie, that's what the page says, I'm not paraphrasing that one.) In GUI mode it attaches to a setroubleshootd server instance and listens for notifications of new alerts. When a new alert arrives it alerts the desktop user via a notification in the status icon area. The user may then click on the alert notification which will open an alert browser. And in addition to the current alert, sealert communicates with the setroubleshootd daemon to access all prior alerts stored in the setroubleshoot database. The archives, the lore, the whole history. 📚

The user may elect to tag any given alert as "ignore" in the browser, which prevents any future notification for the given alert. This is useful when a user is already aware of a reoccurring problem. Lowkey iconic behavior honestly, sometimes you just know.

sealert may also be run in command line mode. The two most useful command line options are -l to "lookup" an alert ID and -a to "analyze" a log file. When setroubleshootd generates a new alert it assigns it a local ID and writes this as a syslog message. The -l lookup option may then be used to retrieve the alert from the setroubleshootd alert database and write it to stdout. This is most useful when setroubleshootd is being run on a headless system without the GUI desktop alert facility. 🖥️✨ And the -a analyze option is equivalent to the "Scan Logfile" command in the browser. The log file is scanned for audit messages, analysis is performed, alerts generated, and then written to stdout. Boom. Done. Ate.

---

🌈 LOG FILE SCANNING 🌈

You may ask sealert to parse a file accumulating all the audit messages it finds in that file. As each audit event is recognized it is presented for analysis which may generate an alert report if the analysis was successful. If the same type of event is seen multiple times resulting in the same report, the results are coalesced into a single report. (Efficiency queen. We love a girl who dedupes. 💅) The report count field will indicate the number of times the tool thought it saw the same issue. The report will also include a list of every line number on which it found an audit record which contributed to the coalesced report. This will allow you to coordinate the contents of the file with the analysis results if need be. Receipts included. 🧾

Log file scanning may be initiated from the sealert browser via the File::ScanLogFile menu, or from the command line via sealert -a filename. Please note that sealert runs as a user level process with the permissions of the user running it. Many system log files are readable by root only. To work around this, if you have root access one can copy the file as root to a temporary file and change its permissions. This is a good solution when scanning via the GUI as a normal user. Or you might consider su'ing to root and run the analysis via the command line (e.g. sealert -a filename).

🚨 Real talk bestie: the audit records in the log file must be valid syntactically correct audit messages, or the parser will ignore them. It will not be nice about it. It will simply pretend they don't exist. 🙈

---

💖 OPTIONS 💖

One bullet per flag, all of them, no skipping, we're thorough in this house:

• -b, --browser — Launch the browser 🌐
• -f, --fix — Execute the fix command for the avc with the given uuid and plugin. Requires the --plugin option, so don't come in here trying to fix things alone, she needs her plus one 💞
• -h, --help — Show this message 🫶
• -s, --service — Start sealert service. Usually used by dbus.
• -S, --noservice — Start sealert without dbus service as stand alone app. Independent. Unbothered. 🌸
• -l, --lookupid id — Lookup alert by id. And if id is the wildcard * then it returns all alerts. She's giving everything to everyone. ✨
• -a, --analyze file — Scan a log file, analyze its AVCs 🔍
• -u, --user — logon as user
• -p, --password — set user password 🔐
• -P, --plugin — Set plugin name associated with the --fix option

---

👑 AUTHOR 👑

This man page was written by John Dennis <jdennis@redhat.com> and Dan Walsh <dwalsh@redhat.com>. Legends, honestly. Respect the elders. 🎀

---

🌟 SEE ALSO 🌟

• selinux(8)

---

Okay that's the whole page, you made it, I'm so proud of you bestie 🥹💜 This was the sealert(8) man page, dated 20061121 — yes, that's a very long time ago and she's still out here doing her thing, a true timeless icon 👑✨ Go forth and debug those SELinux denials, you've got this, slay 💅🌸