Go to file
2015-11-11 14:27:53 -06:00
libs Added arch detection to makefile for x86 and x86_64 2015-11-11 14:27:53 -06:00
Makefile Added arch detection to makefile for x86 and x86_64 2015-11-11 14:27:53 -06:00
README.txt Update readme with -z option 2015-06-07 23:00:43 +02:00
sepolicy-inject.c We can now have a list of permissions instead of just one permission, coma separated 2015-11-11 14:02:15 +01:00

Injects allow rules into binary SELinux kernel policies

Injecting a rule:
$ ./sepolicy-inject -s shell -t system -c file -p read -P sepolicy -o sepolicy2                                   
libsepol.policydb_index_others: security:  1 users, 2 roles, 518 types, 14 bools
libsepol.policydb_index_others: security: 1 sens, 1024 cats
libsepol.policydb_index_others: security:  84 classes, 4539 rules, 162 cond rules

$ sesearch -A -s shell -t system -c file sepolicy
Found 1 semantic av rules:
   allow appdomain domain : file { ioctl read getattr lock open } ; 

$ sesearch -A -s shell -t system -c file sepolicy2
Found 2 semantic av rules:
   allow shell system : file read ; 
   allow appdomain domain : file { ioctl read getattr lock open } ; 

Injecting a permissive domain:
$ ./sepolicy-inject -Z shell -P sepolicy -o sepolicy2

$ seinfo sepolicy | grep Permissive
   Permissives:         0    Polcap:              2

$ seinfo sepolicy2 | grep Permissive
   Permissives:         1    Polcap:              2

Change a permissive domain to non-permissive:
$ ./sepolicy-inject -z shell -P sepolicy -o sepolicy2


TODO:

Insert multiple rules at the same time
Remove rules
Use attributes