tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/tools/README

73 lines
2.7 KiB
Text
Raw Normal View History

Add support for duplicate allow rule detection (-D / --dups). Usage: sepolicy-analyze -D -P out/target/product/<board>/root/sepolicy Displays duplicate allow rules, i.e. pairs of allow rules that grant the same permissions where one allow rule is written directly in terms of individual types and the other is written in terms of attributes associated with those same types. The rule with individual types is a candidate for removal. The rule with individual types may be directly represented in the source policy or may be a result of expansion of a type negation (e.g. domain -foo -bar is expanded to individual allow rules by the policy compiler). Domains with unconfineddomain will typically have such duplicate rules as a natural side effect and can be ignored. Also add a tools/README with a description of all of the tools. Change-Id: I07838dbd22c5cc8a4a65b57003ccae38129050f5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-11-18 00:17:29 +01:00
This directory contains a number of tools related to policy, some of
which are used in building and validating the policy and others are
available for help in auditing and analyzing policy. The tools are
described further below.
Add a script to build multiple SELinux targets. This script will build the SELinux policy for multiple targets in parallel. To use it, run: ./build_policies.sh <Android root directory> <output directory> [specific targets to build] If you do not pass any individual targets, it will build all targets it can find. It will print out the list of failing targets. You can open up the corresponding log file in the output directory to see the exact errors. This script is still a work in progress. It currently cannot discover all build targets (it misses ones "lunch" does not list). Bug: 33463570 Test: Ran script to build multiple targets with and without failures. Change-Id: Iee8ccf4da38e5eb7ce2034431613fe10c65696ab
2018-01-25 00:56:14 +01:00
build_policies.sh
A tool to build SELinux policy for multiple targets in parallel.
This is useful for quickly testing a new test or neverallow rule
on multiple targets.
Usage:
./build_policies.sh ~/android/master ~/tmp/build_policies
./build_policies.sh ~/android/master ~/tmp/build_policies sailfish-eng walleye-eng
Add support for duplicate allow rule detection (-D / --dups). Usage: sepolicy-analyze -D -P out/target/product/<board>/root/sepolicy Displays duplicate allow rules, i.e. pairs of allow rules that grant the same permissions where one allow rule is written directly in terms of individual types and the other is written in terms of attributes associated with those same types. The rule with individual types is a candidate for removal. The rule with individual types may be directly represented in the source policy or may be a result of expansion of a type negation (e.g. domain -foo -bar is expanded to individual allow rules by the policy compiler). Domains with unconfineddomain will typically have such duplicate rules as a natural side effect and can be ignored. Also add a tools/README with a description of all of the tools. Change-Id: I07838dbd22c5cc8a4a65b57003ccae38129050f5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-11-18 00:17:29 +01:00
checkfc
A utility for checking the validity of a file_contexts or a
property_contexts configuration file. Used as part of the policy
build to validate both files. Requires the sepolicy file as an
argument in order to check the validity of the security contexts
in the file_contexts or property_contexts file.
checkfc: add support for comparing two file_contexts files. Extend checkfc to support comparing two file_contexts or file_contexts.bin files. This is for use by the CTS SELinuxHostTest to compare the AOSP general_file_contexts with the device file_contexts.bin file. Depends on I0fe63e0c7f11ae067b5aac2f468f7842e5d76986. Change-Id: I2fff2f8cf87690a76219ddf4cf38939650f34782 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-08-05 18:43:15 +02:00
Usage1:
Add support for duplicate allow rule detection (-D / --dups). Usage: sepolicy-analyze -D -P out/target/product/<board>/root/sepolicy Displays duplicate allow rules, i.e. pairs of allow rules that grant the same permissions where one allow rule is written directly in terms of individual types and the other is written in terms of attributes associated with those same types. The rule with individual types is a candidate for removal. The rule with individual types may be directly represented in the source policy or may be a result of expansion of a type negation (e.g. domain -foo -bar is expanded to individual allow rules by the policy compiler). Domains with unconfineddomain will typically have such duplicate rules as a natural side effect and can be ignored. Also add a tools/README with a description of all of the tools. Change-Id: I07838dbd22c5cc8a4a65b57003ccae38129050f5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-11-18 00:17:29 +01:00
checkfc sepolicy file_contexts
checkfc -p sepolicy property_contexts
checkfc: add support for comparing two file_contexts files. Extend checkfc to support comparing two file_contexts or file_contexts.bin files. This is for use by the CTS SELinuxHostTest to compare the AOSP general_file_contexts with the device file_contexts.bin file. Depends on I0fe63e0c7f11ae067b5aac2f468f7842e5d76986. Change-Id: I2fff2f8cf87690a76219ddf4cf38939650f34782 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-08-05 18:43:15 +02:00
Also used to compare two file_contexts or file_contexts.bin files.
Displays one of subset, equal, superset, or incomparable.
Usage2:
checkfc -c file_contexts1 file_contexts2
Example:
$ checkfc -c out/target/product/shamu/system/etc/general_file_contexts out/target/product/shamu/root/file_contexts.bin
subset
Add support for duplicate allow rule detection (-D / --dups). Usage: sepolicy-analyze -D -P out/target/product/<board>/root/sepolicy Displays duplicate allow rules, i.e. pairs of allow rules that grant the same permissions where one allow rule is written directly in terms of individual types and the other is written in terms of attributes associated with those same types. The rule with individual types is a candidate for removal. The rule with individual types may be directly represented in the source policy or may be a result of expansion of a type negation (e.g. domain -foo -bar is expanded to individual allow rules by the policy compiler). Domains with unconfineddomain will typically have such duplicate rules as a natural side effect and can be ignored. Also add a tools/README with a description of all of the tools. Change-Id: I07838dbd22c5cc8a4a65b57003ccae38129050f5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-11-18 00:17:29 +01:00
checkseapp
A utility for merging together the main seapp_contexts
configuration and the device-specific one, and simultaneously
checking the validity of the configurations. Used as part of the
policy build process to merge and validate the configuration.
Usage:
checkseapp -p sepolicy input_seapp_contexts0 [input_seapp_contexts1...] -o seapp_contexts
insertkeys.py
A helper script for mapping tags in the signature stanzas of
mac_permissions.xml to public keys found in pem files. This
script is described further in the top-level sepolicy/README.
Update README concerning post_process_mac_perms script. Change-Id: Iabda448d252d3b1ce19809c7f5de0dca3942f60c Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-25 18:51:59 +01:00
post_process_mac_perms
A tool to help modify an existing mac_permissions.xml with additional app
certs not already found in that policy. This becomes useful when a directory
containing apps is searched and the certs from those apps are added to the
policy not already explicitly listed.
Usage:
post_process_mac_perms [-h] -s SEINFO -d DIR -f POLICY
-s SEINFO, --seinfo SEINFO seinfo tag for each generated stanza
-d DIR, --dir DIR Directory to search for apks
-f POLICY, --file POLICY mac_permissions.xml policy file
Add support for duplicate allow rule detection (-D / --dups). Usage: sepolicy-analyze -D -P out/target/product/<board>/root/sepolicy Displays duplicate allow rules, i.e. pairs of allow rules that grant the same permissions where one allow rule is written directly in terms of individual types and the other is written in terms of attributes associated with those same types. The rule with individual types is a candidate for removal. The rule with individual types may be directly represented in the source policy or may be a result of expansion of a type negation (e.g. domain -foo -bar is expanded to individual allow rules by the policy compiler). Domains with unconfineddomain will typically have such duplicate rules as a natural side effect and can be ignored. Also add a tools/README with a description of all of the tools. Change-Id: I07838dbd22c5cc8a4a65b57003ccae38129050f5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-11-18 00:17:29 +01:00
sepolicy-check
A tool for auditing a sepolicy file for any allow rule that grants
a given permission.
Usage:
sepolicy-check -s <domain> -t <type> -c <class> -p <permission> -P out/target/product/<board>/root/sepolicy
sepolicy-analyze
A tool for performing various kinds of analysis on a sepolicy
resolved conflicts for merge of 3a1eb33b to lmp-mr1-dev-plus-aosp Change-Id: I5cdc157157b6ed382e4827406bce7406fc2c3e3a
2014-11-19 23:04:11 +01:00
file.
Reference in a new issue Copy permalink