Analysis Settings¶

-p POLICY

Specify the policy to analyze. If none is specified, sedta will search for the policy running on the current system.

-s SOURCE

Specify the source type to use in the domain transition analysis.

-t TARGET

Specify the target type to use in the domain transition analysis. Using this option will also require specifying an analysis algorithm.

Analysis Algorithms¶

sedta uses graph algorithms to analyze the domain transition paths of an SELinux policy. The following algorithms are options for determining paths from a source type to a target type.

-S

Print the shortest domain transition path(s) from the source type to the target type. If multiple paths have the same length, all will be displayed.

-A LIMIT

Print all domain transition path(s) up to LIMIT steps long. Depending on the connectiveness of the policy, this may be extremely expensive.

Analysis Options¶

-r

Perform a reverse domain transition analysis. The domain transitions will be analyzed to find the the parent domains, instead of finding the child domains.

-l LIMIT_TRANS

Specify the maximum number of domain transitions to output. The default is unlimited.

-o OUTPUT_PATH

Generate a graphical representation of the analysis in PNG format at the specified path.

EXCLUDE

A space-separated list of types to exclude from the analysis.

General Options¶

--full

Print rule lists for transitions.

--stats

Print domain transition graph statistics at the end of the analysis.

-h, --help

Print help information and exit.

--version

Print version information and exit.

-v, --verbose

Print additional informational messages.

--debug

Enable debugging output.