1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
|
SELinux Policy Checker Tool Help File
This file contains the basic help information for using sechecker, a
program that runs a series of policy checks (modules) on a policy.
Sechecker is designed to be extensible and configurable so that
developers can easily add new policy checks and configure them to run
in batches with different options.
Each module analyzes a policy. If a policy is not specified on the
command line, the tool uses the system policy by default. In
addition, some checks will require the file_contexts file in order to
run correctly. If the file_contexts file is not specified, the tool
will default to using the system file_contexts file by default.
Checks can be run one at a time on the command line (by specifying a
module) or in a batch (by specifying a profile). The user can create
a custom profile to specify which modules to run, as well as the
modules' options.
The return value of sechecker indicates whether a check failed on the
policy. Therefore sechecker may be used in shell scripts or makefiles
to do conditional branching.
Report Output:
--------------
Sechecker generates a report with the output of each module that was
run. The report includes an explanation of each module, the modules'
severity, and the modules' results. There are three output options to
specify what gets included in the report.
1) quiet - do not print the report
2) short - print the list of results for each module
3) verbose - print the list of results for each module and the list of
proofs for each result
Modules:
--------
A module encapsulates a single check on the policy. Modules may take
options from the current profile; if no profile is given then modules
will use default values. See the help for the specific module(s) to
determine the parameters that may be overridden in a profile.
Each module has a specified severity (high, med, low). These are
defined as follows:
1) "high": The module's results indicate an identifiable security
risk in the SELinux policy.
2) "med": The module's results indicate a flaw in the SELinux policy
that changes the manner in which the policy is enforced; however,
it does not present an identifiable security risk.
3) "low": The module's results indicate a flaw in the policy that
does not affect the manner in which the policy is enforced, but is
considered to be improper.
Profiles:
---------
Three profiles are installed with the sechecker program:
1) development: This profile includes several policy checks of low
and med severity. The checks are common tasks that a policy
developer will consider helpful for writing good policy.
2) analysis: This profile includes several policy checks of med and
low severity that are of higher computational complexity than the
development profile and is not meant to be used frequently by
policy developers.
3) all: This profile runs all known modules.
Profiles can be created to run any set of modules with different
options. The profile can specify the output format for each module.
Other Options:
--------------
The user may specify a minimum module severity to report. For
example, if the minimum severity is "med" and the "all" profile is
used, all modules that are "med" or "high" will be run and the results
for those modules will be reported by sechecker. The "low" severity
modules listed in the profile will be ignored.
|
