Provided by: setools_4.4.4-1build1_amd64 
NAME
sechecker - Configuration-driven automated SELinux policy analysis
SYNOPSIS
sechecker [OPTIONS] config.ini [POLICY]
DESCRIPTION
sechecker is an automated SELinux policy analysis tool. It uses a configuration file to define one or
more analysis checks.
POLICY
A single file containing a binary policy. This file is usually named by version on Linux systems, for
example, policy.30. This file is usually named sepolicy on Android systems. If not provided, sechecker
will attempt to locate and open the current policy running on the system.
OPTIONS
-o <path>
Output the results to the specified path instead of stdout.
-h, --help
Print help information and exit.
--version
Print version information and exit.
-v, --verbose
Print additional informational messages.
--debug
Enable debugging output.
RETURN CODES
sechecker has the following return codes:
0 All checks passed.
1 One or more checks failed.
2 Error in the configuration file.
3 Other errors, such as policy open error.
CONFIGURATION FILE
The configuration file is in the .ini format. Each section is considered a check, with the configuration
section name being the name of the check. All checks have the following options:
check_type = <name>
This selects the type of test be be used in this check. This is required.
desc = <text>
This is an optional text field. If set, the contents are printed in the output and is typically
used to explain the purpose of the check.
disable = <text>
This is an optional text field. If it is set, the check will not run and the contents of this
text will be added to the report to explain why the check was not ran.
TYPE ENFORCEMENT ALLOW RULE ASSERTION
This checks for the nonexistence of type enforcement allow rules. The check_type is assert_te. It will
run the query and any unexpected results from the query, removing any exempted sources or targets, will
be listed as failures. Any expected results that are not seen will also be listed as failures. If a
rule has an empty attribute, rendering it useless, it will be ignored. If a rule has an attribute, it
will be considered a failure unless all of the member types are exempted.
Criteria options:
source = <type or type attribute>
The source type/attribute criteria for the query.
target = <type or type attribute>
The target type/attribute criteria for the query.
tclass = <type or type attribute>[ ....]
A space-separated list of object class criteria for the query.
perms = <type or type attribute>[ ....]
A space-separated list of permissions for the query.
At least one of the above options must be set in this check.
Additional Options:
expect_source = <type or type attribute>[ ....]
A space-separated list of types and type attributes. Each of these types must be seen as the
source of a rule that matches the criteria. At the end of the query, each unseen type in this
list will be reported as a failure. This is optional.
expect_target = <type or type attribute>[ ....]
A space-separated list of types and type attributes. Each of these types must be seen as the
target of a rule that matches the criteria. At the end of the query, each unseen type in this
list will be reported as a failure. This is optional.
exempt_source = <type or type attribute>[ ....]
A space-separated list of types and type attributes. Rules with these as the source will be
ignored. This is optional.
exempt_target = <type or type attribute>[ ....]
A space-separated list of types and type attributes. Rules with these as the target will be
ignored. This is optional.
Note: If a rule has an attribute source, all of the member types must be in the expect_source list or
exempt_source list to pass. Similarly, if a rule has an attribute target, all of the member types must
be in the expect_target list or exempt_target list to pass.
ROLE BASED ACCESS CONTROL ALLOW RULE ASSERTION
This checks for the nonexistence of role based access control (RBAC) allow rules. The check_type is
assert_rbac. It will run the query and any unexpected results from the query, removing any exempted
sources or targets, will be listed as failures. Any expected results that are not seen will also be
listed as failures.
Criteria options:
source = <role
The source role criteria for the query.
target = <role>
The target role criteria for the query.
At least one of the above options must be set in this check.
Additional Options:
expect_source = <role>[ ....]
A space-separated list of roles. Each of these roles must be seen as the source of a rule that
matches the criteria. At the end of the query, each unseen role in this list will be reported as
a failure. This is optional.
expect_target = <role>[ ....]
A space-separated list of roles. Each of these roles must be seen as the target of a rule that
matches the criteria. At the end of the query, each unseen role in this list will be reported as
a failure. This is optional.
exempt_source = <role>[ ....]
A space-separated list of roles. Rules with these as the source will be ignored. This is
optional.
exempt_target = <role>[ ....]
A space-separated list of roles. Rules with these as the target will be ignored. This is
optional.
EMPTY TYPE ATTRIBUTE ASSERTION
This checks that the specified attribute is empty. This can optionally be set to also pass if the
attribute does not exist. The check_type is empty_typeattr.
Options:
attr = <type attribute>
The type attribute to check. This is required.
missing_ok = <type attribute>
Consider the check passing if the attribute does not exist. This is optional. Default is false.
READ-ONLY EXECUTABLES ASSERTION
This checks that all file types that are executable are read-only. The check_type is ro_execs.
Options:
exempt_file = <type or type attribute>[ ....]
A space-separated list of types and type attributes. These will not be considered executable.
This is optional.
exempt_exec_domain = <type or type attribute>[ ....]
A space-separated list of types and type attributes. Rules with these as the source will be
ignored if they allow file execute permission. This is optional.
exempt_write_domain = <type or type attribute>[ ....]
A space-separated list of types and type attributes. Rules with these as the source will be
ignored if they allow file write or append permissions on types determined executable. This is
optional.
CONFIGURATION EXAMPLES
Example 1. A check called "no_unconfined" that will determine if the domain_unconfined_type attribute is
empty or missing.
[no_unconfined]
check_type = empty_typeattr
desc = Verify that the domain_unconfined_type attribute is missing or empty.
attr = domain_unconfined_type
missing_ok = True
Example 2. A check called "ro_execs" that will determine if all executable types are read-only.
[ro_execs]
check_type = ro_execs
desc = Verify that the all executables and libraries are read-only.
Example 3. A check called "execheap" that will determine that there are no domains with the execheap
permission except for unconfined_execheap_t.
[execheap]
check_type = assert_te
desc = Verify no domains have executable heap.
tclass = process
perms = execheap
exempt_source = unconfined_execheap_t
AUTHOR
Chris PeBenito <chpebeni@linux.microsoft.com>
BUGS
Please report bugs via the SETools bug tracker, https://github.com/SELinuxProject/setools/issues
SEE ALSO
apol(1), sediff(1), sedta(1), seinfo(1), seinfoflow(1), sesearch(1)
SELinux Project 2020-06-09 sechecker(1)