selinux - This is the upstream repository for the Security E

项目说明

SELinux Userspace
=================

!SELinux logo
![Run Tests]()
![Run SELinux testsuite in Testing Farm]()
![OSS-Fuzz Status]()
![CIFuzz Status]()
![Check Format]()

SELinux is a flexible Mandatory Access Control (MAC) system built into the
Linux Kernel. SELinux provides administrators with a comprehensi
control mechanism that enables greater access granularity over the existing
Linux Discretionary Access Controls (DAC) and is present in many major Linux
distributions. This repository contains the sources for the SELinux utilities
and system libraries which allow for the configuration and management of an
SELinux-based system.

Please submit all bug reports and patches to the <>
mailing list. You can subscribe by sending an email to <>
Archives of the mailing list are a at

See the SELinux Userspace wiki
for more information.

Minimum Supported Kernel
--------------------------------
The minimum supported kernel is Linux v4.3 to match the
minimum supported kernel policy by libsepol.

Note that the policy build toolchain (e.g. libsepol, checkpolicy,
checkmodule, secilc, semodule_package/expand/link) does not link with
libselinux or have any other runtime dependencies on a particular
Linux kernel . The policy build toolchain has in the past
successfully been built and run on non-Linux platforms as well
(e.g. macOS), although this is not officially supported.

Minimum Supported Policy
---------------------------------
The minimum kernel policy is 30 (xperms_ioctl for SELinux,
xen_de for Xen). Support for this policy first shipped
in libsepol 2.5 (userspace release 20160223), Linux v4.3, and Xen
4.6. libsepol dropped support for kernel policy older than 30
starting with libsepol 3.12.

The minimum modular policy is 18 (xperms_ioctl). Support for
this modular policy first shipped in libsepol 2.7 (userspace
release 20170804). libsepol dropped support for modular policies older
than 18 starting with libsepol 3.12.

These minimum policy in libsepol affect:
1. The policy build toolchain. For example, checkpolicy, checkmodule,
and secilc cannot generate a policy with a less than the
minimum.
2. libselinux and its users. For example, libselinux cannot downgrade a
policy file to a less than the minimum, and libsemanage cannot
read a binary policy module that was compiled with a less than
the minimum.
3. SELinux policy analysis tools. For example, setools cannot read a
policy with a less the minimum.
4. The Xen hypervisor, which compiles its XSM/Flask policies using
checkpolicy, and only currently supports kernel policy 30 for
the Xen target. Xen does not use binary policy modules so it is
unaffected by changes to the minimum modular policy .
5. Android, which is on kernel policy 30. There has not been
any need for newer policy features yet. Android does not use
binary policy modules so it is unaffected by changes to the minimum
modular policy .

Increasing the minimum kernel policy for libsepol therefore
prevents generating, loading, or analyzing policies for Linux kernels
or Xen hyper that only support a kernel policy lower
than the new minimum. The minimum kernel policy should only
be increased when there are no still-supported of the Linux
kernel and Xen hypervisor that require a lower kernel policy .

Increasing the minimum modular policy for libsepol prevents
generating binary modules for distribution releases that only support
a modular policy lower than the new minimum, and also prevents
reading and hence using binary modules that were built with a
lower than the new minimum. This could affect modules originally built
under an older release and carried forward through system upgrades.
The minimum modular policy should only be increased when there
are no still-supported Linux distributions that require a lower
modular policy _and_ any binary modules carried forward
through system upgrades can reasonably be assumed to ha a
rebuild anyway due to major changes to the system policy headers.

Installation
------------

SELinux libraries and tools are packaged in several Linux distributions:

* Alpine Linux ()
* Arch Linux User Repository ()
* Buildroot ()
* Debian and Ubuntu ()
* Gentoo ()
* RHEL and Fedora ()
* SLES and openSUSE ()
* Yocto Project ()
* and many more ()

Building and testing
--------------------

Build dependencies on Fedora:

Build dependencies on Debian:

To build and install e under a private directory, run:

make clean distclean

make DESTDIR=~/obj install install-rubywrap install-pywrap

On Debian the en DEB_PYTHON_INSTALL_LAYOUT needs to be set
to deb when installing the Python wrappers in order to create the correct
Python directory structure.
On Debian systems older than bookworm set
PYTHON_SETUP_ARGS='--install-option "--install-layout=deb"' instead.

To run tests with the built libraries and programs, several paths (relative to $DESTDIR) need to be added to $LD_LIBRARY_PATH, $PATH and $PYTHONPATH.
This can be done using ./scripts/en:

DESTDIR=~/obj ./scripts/en make test

Some tests require the reference policy to be installed (for example in python/sepolgen).

To install as the default system libraries and binaries
(o any pre installed ones - dangerous!),
on x86_64, run:

make LIBDIR=/usr/lib64 SHLIBDIR=/lib64 install install-pywrap relabel

or on x86 (32-bit), run:

make install install-pywrap relabel

This may render your system unusable if the upstream SELinux userspace
lacks library functions or other dependencies relied upon by your
distribution. If it breaks, you get to keep both pieces.

Setting CFLAGS

Setting CFLAGS during the make process will cause the omission of many defaults. While the project strives
to provide a reasonable set of default flags, custom CFLAGS could break the build, or ha undesired
changes on the build output. Thus, be very careful when setting CFLAGS. CFLAGS that are encouraged to be
set when o are:

Setting EXTRA_LD_FLAGS

Build with EXTRA_LD_FLAGS=--undefined- to fix linking against
musl with llvm.

macOS
-----

To install libsepol on macOS (mainly for policy analysis):

cd libsepol; make PREFIX=/usr/local install

This requires GNU coreutils:

brew install coreutils

项目信息

开发语言：C

Star 数：1636

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕This is the upstream repository for the Security Enhanced Linux (SELinux) userland libraries and tools. The software provided by this project complements the SELinux features integrated into the Linux kernel and is used by Linux distributions. All bugs and patches should be submitted to selinux@vger.kernel.org展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。