sechecker - Man Page

sechecker [Options] config.ini [Policy]

sechecker is an automated SELinux policy analysis tool. It uses a configuration file to define one or more analysis checks.

A single file containing a binary policy. This file is usually named by version on Linux systems, for example, policy.30. This file is usually named sepolicy on Android systems.  If not provided, sechecker will attempt to locate and open the current policy running on the system.

-o <path>

Output the results to the specified path instead of stdout.

-h,  --help

Print help information and exit.

--version

Print version information and exit.

-v,  --verbose

Print additional informational messages.

--debug

Enable debugging output.

sechecker has the following return codes:

0

All checks passed.

1

One or more checks failed.

2

Error in the configuration file.

3

Other errors, such as policy open error.

The configuration file is in the .ini format. Each section is considered a check, with the configuration section name being the name of the check.  All checks have the following options:

check_type = <name>

This selects the type of test be be used in this check.  This is required.

desc = <text>

This is an optional text field.  If set, the contents are printed in the output and is typically used to explain the purpose of the check.

disable = <text>

This is an optional text field.  If it is set, the check will not run and the contents of this text will be added to the report to explain why the check was not ran.

This checks for the nonexistence of type enforcement allow rules. The check_type is assert_te.  It will run the query and any unexpected results from the query, removing any exempted sources or targets, will be listed as failures. Any expected results that are not seen will also be listed as failures. If a rule has an empty attribute, rendering it useless, it will be ignored.  If a rule has an attribute, it will be considered a failure unless all of the member types are exempted.

Criteria options:

source = <type or type attribute>

The source type/attribute criteria for the query.

target = <type or type attribute>

The target type/attribute criteria for the query.

tclass = <type or type attribute>[ ....]

A space-separated list of object class criteria for the query.

perms = <type or type attribute>[ ....]

A space-separated list of permissions for the query.

At least one of the above options must be set in this check.

Additional Options:

expect_source = <type or type attribute>[ ....]

A space-separated list of types and type attributes.  Each of these types must be seen as the source of a rule that matches the criteria. At the end of the query, each unseen type in this list will be reported as a failure. This is optional.

expect_target = <type or type attribute>[ ....]

A space-separated list of types and type attributes.  Each of these types must be seen as the target of a rule that matches the criteria. At the end of the query, each unseen type in this list will be reported as a failure. This is optional.

exempt_source = <type or type attribute>[ ....]

A space-separated list of types and type attributes.  Rules with these as the source will be ignored. This is optional.

exempt_target = <type or type attribute>[ ....]

A space-separated list of types and type attributes.  Rules with these as the target will be ignored. This is optional.

Note: If a rule has an attribute source, all of the member types must be in the expect_source list or exempt_source list to pass.  Similarly, if a rule has an attribute target, all of the member types must be in the expect_target list or exempt_target list to pass.

This checks for the nonexistence of role based access control (RBAC) allow rules. The check_type is assert_rbac.  It will run the query and any unexpected results from the query, removing any exempted sources or targets, will be listed as failures. Any expected results that are not seen will also be listed as failures.

Criteria options:

source = <role

The source role criteria for the query.

target = <role>

The target role criteria for the query.

At least one of the above options must be set in this check.

Additional Options:

expect_source = <role>[ ....]

A space-separated list of roles.  Each of these roles must be seen as the source of a rule that matches the criteria. At the end of the query, each unseen role in this list will be reported as a failure. This is optional.

expect_target = <role>[ ....]

A space-separated list of roles.  Each of these roles must be seen as the target of a rule that matches the criteria. At the end of the query, each unseen role in this list will be reported as a failure. This is optional.

exempt_source = <role>[ ....]

A space-separated list of roles.  Rules with these as the source will be ignored. This is optional.

exempt_target = <role>[ ....]

A space-separated list of roles.  Rules with these as the target will be ignored. This is optional.

This checks that the specified attribute is empty.  This can optionally be set to also pass if the attribute does not exist. The check_type is empty_typeattr.

Options:

attr = <type attribute>

The type attribute to check.  This is required.

missing_ok = <type attribute>

Consider the check passing if the attribute does not exist. This is optional.  Default is false.

This checks that all file types that are executable are read-only. The check_type is ro_execs.

Options:

exempt_file = <type or type attribute>[ ....]

A space-separated list of types and type attributes.  These will not be considered executable.  This is optional.

exempt_exec_domain = <type or type attribute>[ ....]

A space-separated list of types and type attributes.  Rules with these as the source will be ignored if they allow file execute permission. This is optional.

exempt_write_domain = <type or type attribute>[ ....]

A space-separated list of types and type attributes.  Rules with these as the source will be ignored if they allow file write or append permissions on types determined executable.  This is optional.

Example 1. A check called "no_unconfined" that will determine if the domain_unconfined_type attribute is empty or missing.

[no_unconfined]
check_type = empty_typeattr
desc = Verify that the domain_unconfined_type attribute is missing or empty.
attr = domain_unconfined_type
missing_ok = True

Example 2. A check called "ro_execs" that will determine if all executable types are read-only.

[ro_execs]
check_type = ro_execs
desc = Verify that the all executables and libraries are read-only.

Example 3. A check called "execheap" that will determine that there are no domains with the execheap permission except for unconfined_execheap_t.

[execheap]
check_type = assert_te
desc = Verify no domains have executable heap.
tclass = process
perms = execheap
exempt_source = unconfined_execheap_t

Chris PeBenito <chpebeni@linux.microsoft.com>

Please report bugs via the SETools bug tracker, https://github.com/SELinuxProject/setools/issues

apol(1), sediff(1), sedta(1), seinfo(1), seinfoflow(1), sesearch(1)