What Have I Modified in SELinux: a new addition to your SELinux toolbox
summary
Tool called WhimSE scans installed packages and the running SELinux policy, downloads package policy versions when needed, and compares modules, module priorities, file contexts, booleans and local semanage changes to report added, removed or overridden policy pieces. It outputs a structured report (outputs JSON/HTML/plain text), traces ABC denials to up to three possible removed or attribute-level allow rules (finds ABC denial causes), supports Distributed SELinux Policies and package-versus-latest comparisons, and runs fast (10 seconds and ~100 MB) versus sedif’s minutes and ~9 GB.
AI-written summary · about
chapters (7)
- 0:00SELinux modifications intro
- 1:26Limitations of SELinux tools
- 2:33Introducing WHIMSY
- 4:40Live demo of WHIMSY
- 7:53Analyzing denials with WHIMSY
- 8:37Get WHIMSY and future plans
- 11:47Q&A
related talks
11mSubsystem Update: State of SELinux, 2019
30mSELint - An SELinux Policy Static Analysis Tool
19mSELinux Update
09mSub-system Update: State of SELinux
15mDSP - custom SELinux policy modules done right
46m20 years of NSA Security Enhanced Linux, a Retrospective
31mOverview and Recent Developments: SELinux
49mSELinux introduction