SELint - An SELinux Policy Static Analysis Tool

on YouTube ↗30m

" summary

SELint is a static-analysis tool for reference-policy SELinux sources (current release 1.1) that parses refpolicy plus its M4 subset, flags style/convention/warning/error issues, and plugs into build pipelines. It finds concrete bugs: missing interface dependencies (led to 57 instances fixed upstream and the reverse 48), unsafe filecontext regexes (unescaped dots), incorrect allow permissions that miss ioctl unless the proper permission macro is used, and ambiguous M4 argument spacing. Checks are configurable, disableable inline, and can fail CI with a nonzero exit.

AI-written summary · about

" chapters (6)

1. 0:00Introduction
2. 0:33What is SELint
3. 2:38Challenges with SELinux policy
4. 10:50Examples
5. 19:00SELint
6. 23:50QA

" related talks

• 14mWhat Have I Modified in SELinux: a new addition to your SELinux toolboxJuraj Marcin · DevConf.CZ 2025
• 19mSELinux UpdatePaul Moore · Linux Security Summit Europe 2025
• 49mSELinux introductionJason Zaman · FOSSASIA Summit 2017
• 31mOverview and Recent Developments: SELinuxPaul Moore · Linux Security Summit Europe 2018
• 11mSubsystem Update: State of SELinux, 2019Paul Moore · Linux Security Summit North America 2019
• 46m20 years of NSA Security Enhanced Linux, a RetrospectiveRussell Coker · linux.conf.au 2022
• 09mSub-system Update: State of SELinuxPaul Moore · Linux Security Summit North America 2018
• 31mSELinux: Myths and RealitiesAlex Callejas · Nerdearla Mexico 2024