sesearch

sesearch is a command-line utility used to query SELinux policy rules. It is part of the Setools toolset and is widely employed for SELinux policy analysis, debugging, and auditing. The program reads the policy store and reports policy rules that would allow a given combination of subject, object, class, and permission.

Common tasks include identifying which permissions a subject type has on a target type, discovering all rules that grant a specific permission, and exploring type transitions and the effect of policy booleans. Queries can be refined by specifying a subject type (-s), an object type (-t), a class (-c), and a permission (-p). Additional options let users focus on matches or display detailed rule contexts.

sesearch outputs a list of matching rules with their policy contexts, such as source type, target type, class, and permission, clarifying whether the rule is an allow statement and how it would affect access decisions. The tool emphasizes policy structure and is used to understand how different elements of the policy interact.

Because it analyzes the policy database directly, sesearch is a diagnostic tool rather than a runtime policy evaluator. It helps policy authors understand the effects of rules, booleans, and type transitions and to verify that a given access path is permitted or denied under the current policy.

Availability and history: sesearch is part of Setools, a suite developed for SELinux policy analysis. It is provided in many Linux distributions that ship SELinux and the Setools package, and is widely used by administrators and developers working with SELinux policies. See also SELinux, Setools, policy analysis tools.