semacro - Man Page
explore and expand SELinux policy macros, interfaces, and templates
Synopsis
semacro [--no-color] [--include-path DIR] command [options]
Description
semacro parses the SELinux reference-policy macro library and provides quick lookup, search, and recursive expansion of interfaces, templates, and defines. It reads .if and .spt files from the policy include tree and builds an in-memory index.
Unlike the raw M4 source, semacro can substitute arguments into macro bodies, recursively expand nested calls into a tree of final policy rules, and output flat copy-paste-ready rules for use in .te policy files.
Global Options
- --no-color
Disable colored output. Color is also disabled automatically when stdout is not a terminal.
- --include-path DIR
Path to the SELinux policy include directory. Overrides the SEMACRO_INCLUDE_PATH environment variable and auto-detection.
- -V, --version
Print the version and exit.
- -h, --help
Print usage information and exit.
Commands
lookup NAME
Show the definition of a macro. NAME may be a bare macro name (e.g. files_pid_filetrans) or a full call with arguments (e.g. "files_pid_filetrans(ntpd_t, ntpd_var_run_t, file)"). When arguments are supplied, positional parameters ($1, $2, ...) are substituted into the body.
Options:
- -e, --expand
Recursively expand nested macro calls into a tree of final policy rules. Permission-set defines (search_dir_perms, read_file_perms, etc.) are resolved inline. Mutually exclusive with -r.
- -r, --rules
Output flat, deduplicated policy rules suitable for pasting directly into a .te file. Access-vector rules with the same source, target, and class are merged. Mutually exclusive with -e.
- -d N, --depth N
Limit expansion depth (default: 10).
For both lookup and find, the positional argument can be read from stdin when piped:
echo "files_pid_filetrans(ntpd_t, ntpd_var_run_t, file)" | semacro lookup -r
find PATTERN
Search for macros whose name matches the Python regular expression PATTERN.
Options:
- -p PERMS, --perms PERMS
Instead of searching by name, find permission-set defines whose resolved value contains all of the space-separated permissions in PERMS. The match is order-independent and subset-based (a define matches if it has at least the requested permissions).
list
List all indexed macros.
- -c CATEGORY, --category CATEGORY
Filter by policy category. Valid values: kernel, system, admin, apps, roles, services, contrib, distributed, support, all (default: all).
callers NAME
Find which macros directly call the given macro (reverse lookup). Useful for understanding the impact of changing a macro definition.
which SOURCE TARGET PERMISSION
Find macros that would grant the requested access. Expands candidate macros with trial arguments and checks the resulting rules for a match.
Options:
- -T, --transition
Search for type_transition rules instead of allow rules. In this mode, the three positional arguments are SOURCE, PARENT_TYPE, NEW_TYPE.
- -C CLASS, --class CLASS
Filter by object class (e.g. file, dir, sock_file).
- -N FILENAME, --name FILENAME
Filter by named transition filename (only with -T).
telookup FILEPATH
Read a .te file, expand every macro call, and output the full set of final policy rules (flat, deduplicated, merged). Use - to read from stdin.
Options:
- -d N, --depth N
Limit expansion depth (default: 10).
- -e, --expand
Output expansion trees for each macro call instead of flat rules.
deps NAME
Walk the call tree of a macro and output a dependency graph. Defaults to DOT (Graphviz) format; use --mermaid for Mermaid format.
Options:
- -m, --mermaid
Output Mermaid format instead of DOT.
- -d N, --depth N
Max depth to follow calls (default: 10).
To render DOT output to an image, pipe to dot(1) (from graphviz):
semacro deps files_pid_filetrans | dot -Tpng -o graph.png
init NAME
Generate starter .te, .if, and .fc files for a new confined daemon. Creates standard type declarations, logging, and PID file handling.
Options:
- -o DIR, --output-dir DIR
Directory to create files in (default: current directory).
Examples
Look up a macro definition:
semacro lookup files_pid_filetrans
Substitute arguments:
semacro lookup "files_pid_filetrans(ntpd_t, ntpd_var_run_t, file)"
Expand into a full policy rule tree:
semacro lookup -e "files_pid_filetrans(ntpd_t, ntpd_var_run_t, file)"
Get flat rules for pasting into a .te file:
semacro lookup -r "apache_read_log(mysqld_t)"
Search for macros matching a pattern:
semacro find "pid_filetrans"
Find defines containing specific permissions:
semacro find --perms "getattr read open"
List macros in the kernel category:
semacro list -c kernel
Find which macros call filetrans_pattern:
semacro callers filetrans_pattern
Find macros granting ntpd_t read access to httpd_log_t:
semacro which ntpd_t httpd_log_t read
Find macros creating a type_transition under var_run_t:
semacro which -T ntpd_t var_run_t ntpd_var_run_t
Expand all macros in a policy module:
semacro telookup myapp.te
Output a dependency graph in DOT format:
semacro deps files_pid_filetrans | dot -Tpng -o graph.png
Generate a policy skeleton for a new daemon:
semacro init myapp
Environment
- SEMACRO_INCLUDE_PATH
Path to the SELinux reference-policy include directory. If not set, semacro tries /usr/share/selinux/devel/include (from selinux-policy-devel).
Files
- /usr/share/selinux/devel/include/
Default policy include directory (provided by selinux-policy-devel).
See Also
Author
Pranav Lawate