seinfo tips — authorized SELinux-policy query literacy

Last updated: · By the BinBench editorial team · Stars and releases checked via the GitHub API
For legal, authorized and educational use only. Only analyze software you own or have written permission to examine.
Quick answer

seinfo (from setools) helps authorized labs sample SELinux policy-query literacy on hosts they own. Pair with sesearch-tips, getenforce-tips, selinux-tips, semodule-tips, ausearch-tips. Prefer lab VMs — never map SELinux policy on foreign hosts without permission.

On this page

Snapshot

FieldValue
Surfaceseinfo tip checklist (types / classes / attributes)
JobAuthorized SELinux policy-query literacy
Peersesearch-tips
Peergetenforce-tips
Peerselinux-tips
Peersemodule-tips

Tip checklist (authorized only)

  1. Confirm you may run seinfo on the lab host (syllabus box you own; setools installed).
  2. Prefer documenting who / why / ticket before any full policy dump — never scrape production policy without change control.
  3. Record short factual notes; quote short Evidence (type/class/attribute labels — never secrets or foreign full dumps).
  4. Optional: allow-rule peer → sesearch-tips.
  5. Optional: mode peer → getenforce-tips.
  6. Prefer disposable lab VMs for seinfo drills; quote non-secret type/class labels afterward as Evidence.
  7. Prefer narrow queries (seinfo -t TYPE) for most Evidence binders — refuse unauthorized recon cookbooks.
  8. Stop at literacy — no attack or unauthorized MAC-bypass cookbooks.

Allowed framing

  • Classroom labs reviewing seinfo -t / -c / -a on authorized disposable hosts.
  • Binding short factual notes as Evidence (type/class/attribute — no secrets).
  • Documenting expected vs observed policy inventory for authorized notes.
  • Comparing seinfo ↔ sesearch / getenforce / selinux / semodule peer tip pages under one binder.
  • Testing syllabus-approved policy queries only when change control authorizes that drill on lab resources.

Scope we will not cover

  • No crack/pirate/keygen via seinfo.
  • No intentional unauthorized SELinux policy reconnaissance against foreign hosts.
  • No secret-theft or full-policy credential harvesting against hosts you do not own.
  • No cookbooks that map SELinux for attack without authorization.
  • No hostile type enumeration framed as exploit steps.

Beginner path (authorized only)

  1. Obtain one syllabus-approved disposable lab host with setools (seinfo) available.
  2. Prefer a throwaway lab VM before any broad policy query.
  3. With authorization, run a narrow seinfo -t (or class/attribute) query; quote selected labels as Evidence.
  4. Optional: peer tip pages above when the syllabus asks.
  5. Stop at literacy — no attack or unauthorized recon cookbooks.

Practical notes for authorized labs

  • seinfo queries the SELinux policy store — keep Evidence labels distinct from sesearch-tips allow-rule drills.
  • Pair with semodule-tips when the syllabus zooms on which module contributed a type.
  • Full policy dumps are huge and may embed sensitive naming — never paste secrets into notes or git.
  • Prefer documenting type/class labels the syllabus authorized without dumping entire policy stores.
  • Never commit raw seinfo full dumps with secrets to git — even for labs.

FAQ-aligned refusals (quick)

  • Foreign-host SELinux policy recon → refuse.
  • Unauthorized MAC-bypass / attack-mapping cookbooks → refuse.
  • Attack/credential-theft framing → refuse.
Which to pick
  • Prefer authorized, redacted, secret-free Evidence.
  • Use sesearch / getenforce / selinux / semodule peer tip pages when the syllabus asks.
  • No crack or unauthorized-access framing.

For legal, authorized and educational use only.

FAQ

What is a "seinfo tip" page in BinBench framing?

A checklist for authorized SELinux policy-query Evidence (seinfo -t / -c / -a on lab policy) on hosts you own or were given syllabus access to — not a cookbook for mapping attack surfaces on foreign servers.

How does this relate to sesearch-tips / getenforce-tips / selinux-tips / semodule-tips?

sesearch-tips covers allow-rule search; getenforce-tips covers mode; selinux-tips covers broader literacy; semodule-tips covers modules. This page zooms on a seinfo tip checklist — it does not overwrite those pages.

Can I run seinfo against hosts I do not own?

No. Authorization first. BinBench will not publish unauthorized SELinux policy reconnaissance against foreign hosts.

Does this teach attack or SELinux-bypass PoCs via seinfo?

No. Mentions of attack/bypass/recon appear only as refusals. Authorized literacy only — prefer lab VMs and redacted type/class lists. Never teach hostile policy mapping as an attack step.

Does this teach secret theft via seinfo?

No. Never paste SELinux policy dumps with secrets, foreign host type inventories, or credential-bearing attributes into notes. Prefer documenting type/class/attribute labels only.

Sources