Chapter 13: Analyzing Policy Behavior
Although SELinux policies enforce the mandatory access controls and application behavior on a system, knowing how a policy will act upfront is useful for administrators to perform assessments and root cause analysis activities.
Throughout this chapter, we will learn how to query the SELinux policy in depth, using a multitude of tools to query process transitions, analyze information flows, and compare policies. We will consider the apol tool, a graphical interface with which we can perform several analyses on a policy, as well as command-line tools such as sesearch, sedta, seinfoflow, and sepolicy. Finally, we will use sediff to compare policies.
In this chapter, we're going to cover the following main topics:
- Performing single-step analysis
- Investigating domain transitions
- Analyzing information flow
- Comparing policies
