These utilities (implemented as a Python module with SWIG bindings) allow you to diff policies ('sediff'), extract metadata ('seinfo'), and run queries to answer questions about the policy ('sesearch'). 'setools' as a project provides a number of utilities that operate on the binary SELinux policy file. This is unfortunate, because this is exactly what I want to do when analyzing the policy from a new device that I did not develop. The problem is that they don't expect anyone else to build the tools to interact with their fork of SELinux (called ' setools').

There's nothing inherently wrong with this and the features added by Google make a lot of sense. It's not easy because Google has decided to fork the SELinux project and alter the project to suit the needs of the Android operating system. Why does that matter today? Because it's still not easy. In fact, I still have to reference the extremely verbose answer provided by StackOverflow user WhiteWinterWolf when answering the question: How can I parse v30 SELinux policies for Android? I realized fairly quickly that the process of analyzing the SEAndroid policy on a given device unexpectedly tricky. In 2017, I started creating tools to process and navigate the SEAndroid details from a given device (part of my dtf project, which hasn't gotten much love lately). For those unfamiliar, this has been a focus of mine since 2016 when I realized how much of an impact SEAndroid was having on the threat landscape of Android devices. In 2018, I spoke at ANYCON on my continued research on SEAndroid. Behind the scenes, however, I've continued to perform embedded device research (not just Android!), and still try to maintain a toolset that works. I haven't been the best about updating my tools or blog in the past 12 months, I know.

Setools