NAME

       seinfoflow - Information flow analysis for SELinux policies

SYNOPSIS

       seinfoflow [OPTIONS] -m MAP -s SOURCE [-t TARGET (-S|-A LIMIT)] [EXCLUDE [EXCLUDE ...]]

DESCRIPTION

       seinfoflow is a command line tool that allows the user to perform information flow analyses on an SELinux
       policy.

POLICY

       A  single  file  containing  a binary policy. This file is usually named by version on Linux systems, for
       example, policy.30. This file is usually named sepolicy  on  Android  systems.   If  no  policy  file  is
       provided, seinfoflow will search for the policy running on the current system. If no policy can be found,
       seinfoflow will print an error message and exit.

PERMISSION MAP

       A file containing mappings of object permissions for object classes.  These mappings are the basis on how
       to compute the infoflow between types.  On Debian a standard permission map can be found when the package
       python3-sepolgen is installed at /var/lib/sepolgen/perm_map.

OPTIONS

   Analysis Settings
       -p POLICY
              Specify the policy to analyze. If none is specified, seinfoflow will search for the policy running
              on the current system.

       -m MAP Specify the path to the permission map file to use in the information flow analysis.

       -s SOURCE
              Specify the source type to use in the information flow analysis.

       -t TARGET
              Specify  the  target  type  to  use  in the information flow analysis. Using this option will also
              require specifying an analysis algorithm.

   Analysis Algorithms
       seinfoflow uses graph algorithms to analyze the  information  flow  paths  of  an  SELinux  policy.   The
       following algorithms are options for determining paths from a source type to a target type.

       -S     Print  the shortest information flow path(s) from the source type to the target type.  If multiple
              paths have the same length, all will be displayed.

       -A LIMIT
              Print all information flow path(s) up to LIMIT steps long.  Depending on the connectiveness of the
              policy, a limit of 5 or more may be extremely expensive.

   Analysis Options
       -w MIN_WEIGHT
              Specify the minimum permission weight to consider for the analysis (1-10). The default is 3.

       -l LIMIT_FLOWS
              Specify the maximum number of information flows to output. The default is unlimited.

       -o OUTPUT_PATH
              Generate a graphical representation of the analysis in PNG format at the specified path.

       EXCLUDE
              A space-separated list of types to exclude from the analysis.

   General Options
       -r, --reverse
              Display information flows into the source type. No effect if a target type is specified.

       --stats
              Print information flow graph statistics at the end of the analysis.

       -h, --help
              Print help information and exit.

       --full Print full rule lists for information flows.

       --version
              Print version information and exit.

       -v, --verbose
              Print additional informational messages.

       --debug
              Enable debugging output.

EXAMPLE

       Show the shortest paths for process running as httpd_t to access user home files, using the default permission map:
       # seinfoflow -s httpd_t -t user_home_t -S
       List all data paths shorter than 3 steps from smbd_t to httpd_log_t, when samba_enable_home_dirs and samba_create_home_dirs booleans are enabled
       # seinfoflow -s smbd_t -t user_home_t -A 3 -b "samba_enable_home_dirs:true,samba_create_home_dirs:true"

AUTHOR

       Chris PeBenito <pebenito@ieee.org>

BUGS

       Please report bugs via the SETools bug tracker, https://github.com/SELinuxProject/setools/issues

SEE ALSO

       apol(1), sediff(1), sedta(1), seinfo(1), sesearch(1)

SELinux Project                                    2016-02-20                                      seinfoflow(1)