mirror of
https://github.com/SELinuxProject/setools
synced 2025-05-16 23:29:16 +00:00
sechecker: Implement sechecker.
This is a command line tool for the configuration file-driven automated policy analysis. Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
This commit is contained in:
Chris PeBenito
parent
bf03b6749c
commit
b58fdc00cd
190
man/sechecker.1
Normal file
190
man/sechecker.1
Normal file
@ -0,0 +1,190 @@
|
|||||||
|
.TH sechecker 1 2020-06-09 "SELinux Project" "SETools: SELinux Policy Analysis Tools"
|
||||||
|
|
||||||
|
.SH NAME
|
||||||
|
sechecker \- Configuration-driven automated SELinux policy analysis
|
||||||
|
|
||||||
|
.SH SYNOPSIS
|
||||||
|
\fBsechecker\fR [OPTIONS] config.ini [POLICY]
|
||||||
|
|
||||||
|
.SH DESCRIPTION
|
||||||
|
.PP
|
||||||
|
\fBsechecker\fR is an automated SELinux policy analysis tool. It uses a
|
||||||
|
configuration file to define one or more analysis checks.
|
||||||
|
|
||||||
|
.SH POLICY
|
||||||
|
.PP
|
||||||
|
A single file containing a binary policy. This file is usually named by version
|
||||||
|
on Linux systems, for example, \fIpolicy.30\fR. This file is usually named
|
||||||
|
\fIsepolicy\fR on Android systems. If not provided, \fBsechecker\fR will attempt
|
||||||
|
to locate and open the current policy running on the system.
|
||||||
|
|
||||||
|
.SH OPTIONS
|
||||||
|
.IP "-o <path>"
|
||||||
|
Output the results to the specified path instead of stdout.
|
||||||
|
.IP "-h, --help"
|
||||||
|
Print help information and exit.
|
||||||
|
.IP "--version"
|
||||||
|
Print version information and exit.
|
||||||
|
.IP "-v, --verbose"
|
||||||
|
Print additional informational messages.
|
||||||
|
.IP "--debug"
|
||||||
|
Enable debugging output.
|
||||||
|
|
||||||
|
.SH RETURN CODES
|
||||||
|
\fBsechecker\fR has the following return codes:
|
||||||
|
.TP
|
||||||
|
.B 0
|
||||||
|
All checks passed.
|
||||||
|
.TP
|
||||||
|
.B 1
|
||||||
|
One or more checks failed.
|
||||||
|
.TP
|
||||||
|
.B 2
|
||||||
|
Error in the configuration file.
|
||||||
|
.TP
|
||||||
|
.B 3
|
||||||
|
Other errors, such as policy open error.
|
||||||
|
|
||||||
|
.SH "CONFIGURATION FILE"
|
||||||
|
The configuration file is in the .ini format. Each section is considered
|
||||||
|
a check, with the configuration section name being the name of the check. All
|
||||||
|
checks have the following options:
|
||||||
|
|
||||||
|
.IP "check_type = <name>"
|
||||||
|
This selects the type of test be be used in this check. This is required.
|
||||||
|
.IP "desc = <text>"
|
||||||
|
This is an optional text field. If set, the contents are printed in the output
|
||||||
|
and is typically used to explain the purpose of the check.
|
||||||
|
.IP "disable = <text>"
|
||||||
|
This is an optional text field. If it is set, the check will not run and the
|
||||||
|
contents of this text will be added to the report to explain why the check
|
||||||
|
was not ran.
|
||||||
|
|
||||||
|
.SH "TYPE ENFORCEMENT ALLOW RULE ASSERTION"
|
||||||
|
This checks for the nonexistence of type enforcement allow rules. The check_type
|
||||||
|
is \fBassert_te\fR. It will run the query and any results from the query,
|
||||||
|
removing any exempted sources or targets, will be listed as failures.
|
||||||
|
If a rule has an empty attribute, rendering it useless, it will
|
||||||
|
be ignored. If a rule has an attribute, it will be considered
|
||||||
|
a failure unless all of the member types are exempted.
|
||||||
|
|
||||||
|
.PP
|
||||||
|
Criteria options:
|
||||||
|
.IP "source = <type or type attribute>"
|
||||||
|
The source type/attribute criteria for the query.
|
||||||
|
.IP "target = <type or type attribute>"
|
||||||
|
The target type/attribute criteria for the query.
|
||||||
|
.IP "tclass = <type or type attribute>[, ....]"
|
||||||
|
A comma-separated list of object class criteria for the query.
|
||||||
|
.IP "perms = <type or type attribute>[, ....]"
|
||||||
|
A comma-separated list of permissions for the query.
|
||||||
|
|
||||||
|
.PP
|
||||||
|
\fBA least one of the above options must be set in this check.\fR
|
||||||
|
|
||||||
|
.PP
|
||||||
|
Additional Options:
|
||||||
|
|
||||||
|
.IP "exempt_source = <type or type attribute>[, ....]"
|
||||||
|
A comma-separated list of types and type attributes. Rules with these
|
||||||
|
as the source will be ignored. This is optional.
|
||||||
|
.IP "exempt_target = <type or type attribute>[, ....]"
|
||||||
|
A comma-separated list of types and type attributes. Rules with these
|
||||||
|
as the target will be ignored. This is optional.
|
||||||
|
|
||||||
|
.SH "EMPTY TYPE ATTRIBUTE ASSERTION"
|
||||||
|
This checks that the specified attribute is empty. This can optionally
|
||||||
|
be set to also pass if the attribute does not exist.
|
||||||
|
The check_type is \fBempty_typeattr\fR.
|
||||||
|
|
||||||
|
.PP
|
||||||
|
Options:
|
||||||
|
.IP "attr = <type attribute>"
|
||||||
|
The type attribute to check. This is required.
|
||||||
|
.IP "missing_ok = <type attribute>"
|
||||||
|
Consider the check passing if the attribute does not exist.
|
||||||
|
This is optional. Default is false.
|
||||||
|
|
||||||
|
.SH "READ-ONLY EXECUTABLES ASSERTION"
|
||||||
|
This checks that all file types that are executable are read-only.
|
||||||
|
The check_type is \fBro_execs\fR.
|
||||||
|
|
||||||
|
.PP
|
||||||
|
Options:
|
||||||
|
.IP "exempt_file = <type or type attribute>[, ....]"
|
||||||
|
A comma-separated list of types and type attributes. These
|
||||||
|
will not be considered executable. This is optional.
|
||||||
|
.IP "exempt_exec_domain = <type or type attribute>[, ....]"
|
||||||
|
A comma-separated list of types and type attributes. Rules with these
|
||||||
|
as the source will be ignored if they allow file execute permission.
|
||||||
|
This is optional.
|
||||||
|
.IP "exempt_write_domain = <type or type attribute>[, ....]"
|
||||||
|
A comma-separated list of types and type attributes. Rules with these
|
||||||
|
as the source will be ignored if they allow file write or append permissions
|
||||||
|
on types determined executable. This is optional.
|
||||||
|
|
||||||
|
.SH "CONFIGURATION EXAMPLES"
|
||||||
|
|
||||||
|
.PP
|
||||||
|
\fBExample\ \&1.\ \&A check called "no_unconfined" that will determine if the
|
||||||
|
domain_unconfined_type attribute is empty or missing.\fR
|
||||||
|
.sp
|
||||||
|
.if n \{\
|
||||||
|
.RS 4
|
||||||
|
.\}
|
||||||
|
.nf
|
||||||
|
[no_unconfined]
|
||||||
|
check_type = empty_typeattr
|
||||||
|
desc = Verify that the domain_unconfined_type attribute is missing or empty.
|
||||||
|
attr = domain_unconfined_type
|
||||||
|
missing_ok = True
|
||||||
|
.fi
|
||||||
|
.if n \{\
|
||||||
|
.RE
|
||||||
|
.\}
|
||||||
|
|
||||||
|
.PP
|
||||||
|
\fBExample\ \&2.\ \&A check called "ro_execs" that will determine if all
|
||||||
|
executable types are read-only.\fR
|
||||||
|
.sp
|
||||||
|
.if n \{\
|
||||||
|
.RS 4
|
||||||
|
.\}
|
||||||
|
.nf
|
||||||
|
[ro_execs]
|
||||||
|
check_type = empty_typeattr
|
||||||
|
desc = Verify that the all executables and libraries are read-only.
|
||||||
|
.fi
|
||||||
|
.if n \{\
|
||||||
|
.RE
|
||||||
|
.\}
|
||||||
|
|
||||||
|
.PP
|
||||||
|
\fBExample\ \&3.\ \&A check called "execheap" that will determine that
|
||||||
|
there are no domains with the execheap permission except for
|
||||||
|
unconfined_execheap_t.\fR
|
||||||
|
.sp
|
||||||
|
.if n \{\
|
||||||
|
.RS 4
|
||||||
|
.\}
|
||||||
|
.nf
|
||||||
|
[execheap]
|
||||||
|
check_type = assert_te
|
||||||
|
desc = Verify no domains have executable heap.
|
||||||
|
tclass = process
|
||||||
|
perms = execheap
|
||||||
|
exempt_source = unconfined_execheap_t
|
||||||
|
.fi
|
||||||
|
.if n \{\
|
||||||
|
.RE
|
||||||
|
.\}
|
||||||
|
.PP
|
||||||
|
|
||||||
|
.SH AUTHOR
|
||||||
|
Chris PeBenito <chpebeni@linux.microsoft.com>
|
||||||
|
|
||||||
|
.SH BUGS
|
||||||
|
Please report bugs via the SETools bug tracker, https://github.com/SELinuxProject/setools/issues
|
||||||
|
|
||||||
|
.SH SEE ALSO
|
||||||
|
apol(1), sediff(1), sedta(1), seinfo(1), seinfoflow(1), sesearch(1)
|
||||||
74
sechecker
Executable file
74
sechecker
Executable file
@ -0,0 +1,74 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
# Copyright 2020 Microsoft Corporation
|
||||||
|
#
|
||||||
|
# This file is part of SETools.
|
||||||
|
#
|
||||||
|
# SETools is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU General Public License as published by
|
||||||
|
# the Free Software Foundation, either version 2 of the License, or
|
||||||
|
# (at your option) any later version.
|
||||||
|
#
|
||||||
|
# SETools is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with SETools. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
#
|
||||||
|
|
||||||
|
import setools
|
||||||
|
import argparse
|
||||||
|
import sys
|
||||||
|
import logging
|
||||||
|
import signal
|
||||||
|
|
||||||
|
signal.signal(signal.SIGPIPE, signal.SIG_DFL)
|
||||||
|
|
||||||
|
parser = argparse.ArgumentParser(description="SELinux policy checker tool.")
|
||||||
|
parser.add_argument("--version", action="version", version=setools.__version__)
|
||||||
|
parser.add_argument("config", help="Path to the checker configuration file.")
|
||||||
|
parser.add_argument("policy", help="Path to the SELinux policy to check.", nargs="?")
|
||||||
|
parser.add_argument("-o", "--output_file", help="Path to log output.", required=False)
|
||||||
|
parser.add_argument("-v", "--verbose", action="store_true",
|
||||||
|
help="Print extra informational messages")
|
||||||
|
parser.add_argument("--debug", action="store_true", dest="debug", help="Enable debugging.")
|
||||||
|
|
||||||
|
args = parser.parse_args()
|
||||||
|
|
||||||
|
if args.debug:
|
||||||
|
logging.basicConfig(level=logging.DEBUG,
|
||||||
|
format='%(asctime)s|%(levelname)s|%(name)s|%(message)s')
|
||||||
|
elif args.verbose:
|
||||||
|
logging.basicConfig(level=logging.INFO, format='%(message)s')
|
||||||
|
else:
|
||||||
|
logging.basicConfig(level=logging.WARNING, format='%(message)s')
|
||||||
|
|
||||||
|
try:
|
||||||
|
p = setools.SELinuxPolicy(args.policy)
|
||||||
|
c = setools.PolicyChecker(p, args.config)
|
||||||
|
|
||||||
|
if args.output_file:
|
||||||
|
with open(args.output_file, "w") as fd:
|
||||||
|
failures = c.run(output=fd)
|
||||||
|
|
||||||
|
else:
|
||||||
|
failures = c.run()
|
||||||
|
|
||||||
|
sys.exit(1 if failures else 0)
|
||||||
|
|
||||||
|
except setools.exception.InvalidCheckerConfig as err:
|
||||||
|
if args.debug:
|
||||||
|
raise
|
||||||
|
else:
|
||||||
|
print(err)
|
||||||
|
|
||||||
|
sys.exit(2)
|
||||||
|
|
||||||
|
except Exception as err:
|
||||||
|
if args.debug:
|
||||||
|
raise
|
||||||
|
else:
|
||||||
|
print(err)
|
||||||
|
|
||||||
|
sys.exit(3)
|
||||||
Loading…
Reference in New Issue
Block a user