sesearch

Search for all allow rules in the policy

$ sesearch --allow

$ sesearch --allow -t [type_name]

$ sesearch --allow -s [source_type]

$ sesearch --allow -c [class_name] -p [permission]

$ sesearch --type_transition -s [source_type]

$ sesearch --allow -t [type_name] -v

sesearch [OPTIONS] [EXPRESSION] [POLICY]

sesearch is a SELinux policy query tool from the setools package that allows users to search and analyze rules within a SELinux policy. It can query both binary policy files (typically named policy.XX) and modular policies, making it essential for SELinux policy debugging and development.
The tool supports searching various rule types including allow rules, type transitions, role-based access control rules, and MLS (Multi-Level Security) range transitions. Results can be filtered by source type, target type, object class, permissions, and Boolean conditions.

-A, --allow

Search for allow and allowxperm rules

Search for type_transition rules

Search for auditallow rules

Search for dontaudit rules

Find rules with matching source type/attribute

Find rules with matching target type/attribute

Find rules with matching object class

Find rules with matching permissions (comma-separated)

Find rules with matching conditional Boolean

Match source type directly, not by attribute

Match target type directly, not by attribute

Display additional rule information

Print version and exit

Policy files must be accessible; default location is /sys/fs/selinux/policy on running systems. Results may differ between policy versions. Searching large policies without filters can produce extensive output. Extended permission rules (xperm) require separate flags from standard permission searches.

sesearch is part of the SETools (SELinux Policy Tools) project, originally developed at Tresys Technology starting in 2001 to provide analysis capabilities for SELinux policies. The setools package has evolved alongside SELinux, which was integrated into the Linux kernel mainline in 2003. Current maintenance continues under the setools project on GitHub.

seinfo(1), semodule(8), sestatus(8), getsebool(8)