This directory contains a number of tools related to policy, some of
which are used in building and validating the policy and others are
available for help in auditing and analyzing policy. The tools are
described further below.
checkfc
A utility for checking the validity of a file_contexts or a
property_contexts configuration file. Used as part of the policy
build to validate both files. Requires the sepolicy file as an
argument in order to check the validity of the security contexts
in the file_contexts or property_contexts file.
Usage:
checkfc sepolicy file_contexts
checkfc -p sepolicy property_contexts
checkseapp
A utility for merging together the main seapp_contexts
configuration and the device-specific one, and simultaneously
checking the validity of the configurations. Used as part of the
policy build process to merge and validate the configuration.
Usage:
checkseapp -p sepolicy input_seapp_contexts0 [input_seapp_contexts1...] -o seapp_contexts
insertkeys.py
A helper script for mapping tags in the signature stanzas of
mac_permissions.xml to public keys found in pem files. This
script is described further in the top-level sepolicy/README.
post_process_mac_perms
A tool to help modify an existing mac_permissions.xml with additional app
certs not already found in that policy. This becomes useful when a directory
containing apps is searched and the certs from those apps are added to the
policy not already explicitly listed.
Usage:
post_process_mac_perms [-h] -s SEINFO -d DIR -f POLICY
-s SEINFO, --seinfo SEINFO seinfo tag for each generated stanza
-d DIR, --dir DIR Directory to search for apks
-f POLICY, --file POLICY mac_permissions.xml policy file
sepolicy-check
A tool for auditing a sepolicy file for any allow rule that grants
a given permission.
Usage:
sepolicy-check -s <domain> -t <type> -c <class> -p <permission> -P out/target/product/<board>/root/sepolicy
sepolicy-analyze
A tool for performing various kinds of analysis on a sepolicy
file.
William Roberts
authored
rule_map_free() took as a parameter a boolean menu rule_map_switch
that was used to determine if it should free the key pointer that
is also in the table. On GLIBC variants, calls to hdestroy do not
free the key pointer, on NON-GLIBC variants, it does. The original
patch was meant to correct this, however, it always passes "destroy"
as the rule_map_switch. On GLIBC variants this is fine, however on
NON-GLIBC variants, that free was compiled out, and the free() was
handled by hdestroy. In cases of failure where the rule_map was not
in the htable, those key's were not properly free'd.
Change-Id: Ifdf616e09862bca642a4d31bf0cb266168170e50
Signed-off-by: 
William Roberts <william.c.roberts@intel.com>| Name | Last commit | Last update |
|---|---|---|
| .. | ||
| sepolicy-analyze | ||
| Android.mk | ||
| README | ||
| check_seapp.c | ||
| checkfc.c | ||
| insertkeys.py | ||
| post_process_mac_perms | ||
| sepolicy-check.c | ||