• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1This directory contains a number of tools related to policy, some of
2which are used in building and validating the policy and others are
3available for help in auditing and analyzing policy.  The tools are
4described further below.
5
6build_policies.sh
7   A tool to build SELinux policy for multiple targets in parallel.
8   This is useful for quickly testing a new test or neverallow rule
9   on multiple targets.
10
11   Usage:
12   ./build_policies.sh ~/android/master ~/tmp/build_policies
13   ./build_policies.sh ~/android/master ~/tmp/build_policies sailfish-eng walleye-eng
14
15checkfc
16   A utility for checking the validity of a file_contexts or a
17   property_contexts configuration file.  Used as part of the policy
18   build to validate both files.  Requires the sepolicy file as an
19   argument in order to check the validity of the security contexts
20   in the file_contexts or property_contexts file.
21
22   Usage1:
23   checkfc sepolicy file_contexts
24   checkfc -p sepolicy property_contexts
25
26   Also used to compare two file_contexts or file_contexts.bin files.
27   Displays one of subset, equal, superset, or incomparable.
28
29   Usage2:
30   checkfc -c file_contexts1 file_contexts2
31
32   Example:
33   $ checkfc -c out/target/product/shamu/system/etc/general_file_contexts out/target/product/shamu/root/file_contexts.bin
34   subset
35
36checkseapp
37    A utility for merging together the main seapp_contexts
38    configuration and the device-specific one, and simultaneously
39    checking the validity of the configurations. Used as part of the
40    policy build process to merge and validate the configuration.
41
42    Usage:
43    checkseapp -p sepolicy input_seapp_contexts0 [input_seapp_contexts1...] -o seapp_contexts
44
45insertkeys.py
46    A helper script for mapping tags in the signature stanzas of
47    mac_permissions.xml to public keys found in pem files.  This
48    script is described further in the top-level sepolicy/README.
49
50post_process_mac_perms
51    A tool to help modify an existing mac_permissions.xml with additional app
52    certs not already found in that policy. This becomes useful when a directory
53    containing apps is searched and the certs from those apps are added to the
54    policy not already explicitly listed.
55
56    Usage:
57    post_process_mac_perms [-h] -s SEINFO -d DIR -f POLICY
58
59      -s SEINFO, --seinfo SEINFO  seinfo tag for each generated stanza
60      -d DIR, --dir DIR           Directory to search for apks
61      -f POLICY, --file POLICY    mac_permissions.xml policy file
62
63sepolicy-check
64    A tool for auditing a sepolicy file for any allow rule that grants
65    a given permission.
66
67    Usage:
68    sepolicy-check -s <domain> -t <type> -c <class> -p <permission> -P out/target/product/<board>/root/sepolicy
69
70sepolicy-analyze
71    A tool for performing various kinds of analysis on a sepolicy
72    file.
73