sediff(1)

NAME
sediff - SELinux policy difference tool

SYNOPSIS
sediff [OPTIONS] [EXPRESSION] POLICY1 POLICY2

DESCRIPTION
Determine the differences between two SELinux policies.

POLICY

A single file containing a binary policy. This file is usually named by version on Linux systems, for example, policy.30. This file is usually named sepolicy on Android systems. If not provided, sediff will print an error message and exit.

EXPRESSIONS

The user may specify an expression listing the policy elements to differentiate. If not provided, all supported policy elements are examined.

  Component Differences

--common
    Find differences in common permission sets.

-c, --class
    Find differences in object classes.

-t, --type
    Find differences in attributes associated with types.

-a, --attribute
    Find differences in types assigned to attributes.

-r, --role
    Find differences in types authorized for roles.

-u, --user
    Find differences in roles authorized for users.

-b, --bool
    Find differences in the default values of booleans.

--sensitivity
    Find differences in sensitivity definitions.

--category
    Find differences in category definitions.

--level
    Find differences in MLS level definitions.

  Type Enforcement Rule Differences

-A  Find differences in allow and allowxperm rules.

--allow
    Find differences in allow rules.

--auditallow
    Find differences in auditallow rules.

--dontaudit
    Find differences in dontaudit rules.

--allowxperm
    Find differences in allowxperm rules.

--auditallowxperm
    Find differences in auditallowxperm rules.

--dontauditxperm
    Find differences in dontauditxperm rules.

-T, --type_trans
    Find differences in type_transition rules.

--type_member
    Find differences in type_member rules.

--type_change
    Find differences in type_change rules.

  RBAC Rule Differences

--role_allow
    Find differences in role allow rules.

--role_trans
    Find differences in role_transition rules.

  MLS Rule Differences

--range_trans
    Find differences in range_transition rules.

  Constraint Differences

--constrain
    Find differences in constrain rules.

--mlsconstrain
    Find differences in mlsconstrain rules.

--validatetrans
    Find differences in validatetrans rules.

--mlsvalidatetrans
    Find differences in mlsvalidatetrans rules.

  Labeling Statement Differences

--ibendportcon
    Find differences in ibendportcon (InfiniBand endport context) statements.

--ibpkeycon
    Find differences in ibpkeycon (InfiniBand partition key context) statements.

--initialsid
    Find differences in initial SID statements.

--fs_use
    Find differences in fs_use_* statements.

--genfscon
    Find differences in genfscon statements.

--netifcon
    Find differences in netifcon statements.

--nodecon
    Find differences in nodecon statements.

--portcon
    Find differences in portcon statements.

  Other Differences

--default
    Find differences in default_* statements.

--property
    Find differences in policy properties. Only applicable for binary policies (policy version, MLS enabled/disabled, unknown permissions setting).

--polcap
    Find differences in policy capabilities.

--typebounds
    Find differences in typebound statements.

OPTIONS

-h, --help
    Print help information and exit.

--stats
    Print difference statistics only.

--version
    Print version information and exit.

-v, --verbose
    Print additional informational messages.

--debug
    Enable debugging output.

DIFFERENCES

sediff categorizes differences in policy elements into one of three forms.

    added
        The element exists only in the modified policy.

    removed
        The element exists only in the original policy.

    modified
        The element exists in both policies but its semantic meaning has changed. For example, a class is modified if one or more permissions are added or removed.

EXAMPLE
Show differences in boolean settings
# sediff -b /backup/policy.33 /etc/selinux/targeted/policy/policy.33
Show statistics for allow and allowxperm rule changes (how many rules where added, removed, or modified)
#sediff -A --stats /backup/policy.33 /etc/selinux/targeted/policy/policy.33

AUTHOR
Chris PeBenito <pebenito@ieee.org>

BUGS
Please report bugs via the SETools bug tracker, https://github.com/SELinuxProject/setools/issues

SEE ALSO
apol(1), sedta(1), seinfo(1), seinfoflow(1), sesearch(1)