12

I need to know everything related to a selinux type on a running system's current rules:

  • allow, allowaudit, dontaudit rules.
  • files labeled with a context using the type.
  • transitions.

...and any other info.

Is there any command(s) I can use to query for that info or should I download the all selinux related "src" packages, filter out the modules not in use and grep every file for that info? There must be an easier way to do that.

Yanko Hernández Álvarez
  • 574
  • 2
  • 8
  • 18

1 Answers1

13

Some of the commands to obtain this info are (examples use httpd_log_t):

  1. seinfo

    # seinfo -x --type=httpd_log_t /etc/selinux/default/policy/policy.26
   httpd_log_t
      file_type
      non_security_file_type
      logfile

  2. sesearch

    # sesearch --dontaudit -t httpd_log_t /etc/selinux/default/policy/policy.26 | head
Found 35 semantic av rules:
    dontaudit run_init_t file_type : dir { getattr search open } ;
    dontaudit staff_t non_security_file_type : file getattr ;
    dontaudit staff_t non_security_file_type : dir { ioctl read getattr lock search open } ;
    dontaudit staff_t non_security_file_type : lnk_file getattr ;
    dontaudit staff_t non_security_file_type : sock_file getattr ;
    dontaudit staff_t non_security_file_type : fifo_file getattr ;
    dontaudit unconfined_t non_security_file_type : file getattr ;
    dontaudit unconfined_t non_security_file_type : dir { ioctl read getattr lock search open } ;
    dontaudit unconfined_t non_security_file_type : lnk_file getattr ;

  3. semanage

    # semanage fcontext -l | grep httpd_log_t
/etc/httpd/logs                                    all files          system_u:object_r:httpd_log_t:s0
/var/log/apache(2)?(/.*)?                          all files          system_u:object_r:httpd_log_t:s0
/var/log/apache-ssl(2)?(/.*)?                      all files          system_u:object_r:httpd_log_t:s0
/var/log/cacti(/.*)?                               all files          system_u:object_r:httpd_log_t:s0
/var/log/cgiwrap\.log.*                            regular file       system_u:object_r:httpd_log_t:s0
/var/log/horde2(/.*)?                              all files          system_u:object_r:httpd_log_t:s0
/var/log/httpd(/.*)?                               all files          system_u:object_r:httpd_log_t:s0
/var/log/lighttpd(/.*)?                            all files          system_u:object_r:httpd_log_t:s0
/var/log/piranha(/.*)?                             all files          system_u:object_r:httpd_log_t:s0
/var/www(/.*)?/logs(/.*)?                          all files          system_u:object_r:httpd_log_t:s0

References: RHEL6 SELinux manual

dawud
  • 15,096
  • 3
  • 42
  • 61
  • is there any way to know which modules use a specified type? i.e. how to connect that info to the loaded selinux policy module (semodule -l)? – Yanko Hernández Álvarez Jul 05 '13 at 13:14
  • OK, I will reduce the scope of the question to mark this answer as accepted and separate the first aspect to another question. – Yanko Hernández Álvarez Jul 08 '13 at 16:48
  • @YankoHernándezÁlvarez believe it or not, I've trying to figure that out. I've post my findings in you other question. – dawud Jul 08 '13 at 19:02
  • 1
    For those looking, that other question is [here](https://serverfault.com/questions/521668/how-to-match-selinux-rules-transitions-labels-etc-to-modules). – Michael Mol May 24 '17 at 16:31