Red Hat ENTERPRISE LINUX 4 - SELINUX GUIDE Manual

Also see for ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE: Installation guide Installation guide Tuning guide Installation guide Manual

Contents

Chapter 5. Controlling and Maintaining SELinux 715.3.2. Dump or View PolicyWhile there is no formal way to dump the policy in memory, there are several tools which make iteasier to view and analyze policy. Here are three ways of viewing the policy.• The binary policy directory at $SELINUX_POLICY/ contains information on Booleans and filecontexts. You can analyze the binary policy with the setools such as apol and seinfo, which arediscussed in Chapter 6 Tools for Manipulating and Analyzing SELinux.You can read more about where the policy files are located starting in Section 2.2 Where is thePolicy?.• For a more thorough analysis, nothing equals the policy source, located in $SELINUX_SRC/ anddiscussed extensively in Chapter 2 SELinux Policy Overview and Chapter 3 Targeted PolicyOverview.Standard command line text processing tools and the setools are two essential methods for view-ing and understanding the policy source.• Currently, the best method for analyzing SELinux policy is to use the setools. One GUI toolin particular is apol, which provides fairly complex analysis capabilities. This is discussed morethoroughly in Section 6.3 Using apol for Policy Analysis.5.3.3. Dump and View LogsThe SELinux implementation in Red Hat Enterprise Linux 4 routes AVC audit messages to/var/log/messages. You can seek just the audit messages using grep and searching for avc oraudit.As discussed in Section 6.2 Using seaudit for Audit Log Analysis, seaudit is a GUI tool for organiz-ing and analyzing just policy messages. The tool seaudit-report generates text or HTML reportsof audit messages.5.3.4. Viewing AVC StatisticsThe best way to view formatted statistics about the access vector cache is to use avcstat. This isexplained in Section 6.1 Information Gathering Tools.5.4. Policy Writer Control of SELinuxWriting SELinux policy is not a trivial undertaking. The topic cannot easily be covered in a few,simple how-to steps. If you are interested in this topic, read Chapter 7 Compiling SELinux Policy andChapter 8 Customizing and Writing Policy. Those chapters contain information on writing, testing,loading, and validating a policy.