Get the context of a process by pid number Same as getconlist but only returns the first context Uses security_compute_user(3) and orders the resulting list based on default_contexts file and per-user context files Query the kernel security server for a set of reachable user contexts from a source context Query the kernel security server for a relabel decision Query the kernel security server for a labeling decision on a polyinstanciated object Query the kernel security server for a transition decision Query the kernel security server for an access vector decision

Verify that a context is valid in an on-disk policy Give statistics about the in-kernel access vector cache, such as number of lookups, hits and misses They may be installed on end-systems during development and testing but not typically during production. Semodule-utils (2.7) or policycoreutils (<= 2.6)ĭebugging tools give policy developers and SELinux toolchain developers information useful in finding or troubleshooting a problem related to SELinux. Generate documentation from reference policy xml commentsĬreate a policy package from a compiled module and optionally file context, seuser, userextra, and netfilter context file Tool included with the reference policy that sorts filecontext files during policy build time Tool nameĬreate a policy module from a module source fileĬreate a kernel policy from a policy source file They would not be used on secure end-systems. They are required on systems that intend to build policies from source, including production systems that use tools such as audit2allow to add new policy rules at runtime. Query a policy file for various parts of the policy such as te rules, symbols, etcīuild time tools are used during building a policy from source into modules or a monolithic kernel policy. Perform a semantic difference between two policies Perform many analyses on the target policy including domain transition, information flow, standard queries, filesystem analysis and so on They are required on development systems being used to analyze a target policy, and are rarely installed on the target production systems. These tools form the basis on which we can make claims concerning the security properties of an SELinux system.

Analysis tools are primarily used to analyze the on-disk policy for certain criteria, for example information flow.

Selinux python setools aur