SUMMARY

	SELint is a program to perform static code analysis on SELinux policy
	source files


INSTALLING FROM TAR DOWNLOAD

	To install from a downloaded tarball, first install the following dependencies:

	On rpm based distros:
		uthash-devel
		libconfuse
		libconfuse-devel
		check
		check-devel

	On apt based distros:
		uthash-dev
		libconfuse-dev
		check

	Then run:

	./configure
	make
	make install

INSTALLING FROM GIT

	If you are building from a git repo checkout, you'll also need bison, flex,
	autotools (automake, autoconf, aclocal, autoreconf) and the autoconf-archive package.
	Then you can run ./autogen.sh to set up autotools and then follow the steps above.

USAGE

	selint [OPTIONS] FILE [...]

OPTIONS

	-c CONFIGFILE, --config=CONFIGFILE
		Override default config with config specified on command line.  See
		CONFIGURATION section for config file syntax.

	--color=COLOR_OPTION
		Configure color output.  Options are on, off and auto (the default).

	--context=CONTEXT_PATH
		Also parse any .te or .if files found in CONTEXT_PATH and load symbols
		associated with them for use when checking the policy files to be analyzed.
		No checks are run on these files. Implies -s.

	--debug-parser
		Enable debug output for the internal policy parser.
		Very noisy, useful to debug parsing failures.

	-d CHECKID, --disable=CHECKID
		Disable check with the given ID.

	-e CHECKID, --enable=CHECKID
		Enable check with the given ID.

	-E, --only-enabled
		Only run checks that are explicitly enabled with the --enable option.

	-F, --fail
		Exit with a non-zero value if any issue was found.

	-h, --help
		Show help menu about command line options.

	-l LEVEL, --level=LEVEL
		Only list errors with a severity level at or greater than LEVEL.  Options
		are C (convention), S (style), W (warning), E (error), F (fatal error).  See
		SEVERITY LEVELS for more information.  If this option is not specified,
		SELint will default to the level selected in the applicable config file.

	--scan-hidden-dirs
		Scan hidden directories.  By default hidden directories (like '.git') are
		skipped in recursive mode.

	-s, --source
		Run in "source mode" to scan a policy source repository that is designed to
		compile into a full system policy.  If this flag is not specified, SELint
		will assume that scanned policy files are intended to be loaded into the
		currently running system policy.

	-S, --summary
		Display a summary of issues found after running the analysis.

	--summary-only
		Only display a summary of issues found after running the analysis.
		Do not show the individual findings.  Implies -S.

	-r, --recursive
		Scan recursively and check all SELinux policy files found.

	-v, --verbose
		Enable verbose output

	-V, --version
		Show version information and exit.

CONFIGURATION

	A global configuration is specified at the install prefix supplied to
	./configure (typically /usr/local/etc).  This can be overridden on the command
	line using the -c option.

	Options specified on the command line override options from the config file.

	See the global config file for details on config file syntax.

SEVERITY LEVELS

	SELint messages are assocatied with a severity level, indicating the
	significance of the issue.  Available levels are listed below in increasing
	order of significance.

	X (extra) - Miscellaneous checks, mainly for policy introspection.
	These must be explicitly enabled with their individual identifier.
	C (convention) - A violation of common style conventions
	S (style) - Stylistic "code smell" that may be associated with unintended
	behavior
	W (warning) - Non standard policy that may result in issues such as run time
	errors or security issues
	E (error) - Important issues that may result in errors at compile time or
	run time
	F (fatal error) - Error that prevents further processing

SELINT EXCEPTIONS

	To eliminate one or more checks on one line, add a comment containing a string
	in any of the following formats:

	* "selint-disable:E-003"
	* "selint-disable: E-003"
	* "selint-disable:E-003,E-004"
	* "selint-disable: E-003, E-004"

	This is currently only supported in te and if files

OUTPUT

	SELint outputs messages in the following format:

	[filename]:[lineno]: ([SEVERITY LEVEL]): [MESSAGE] ([ISSUE ID])

	For example:

	example.te:127: (E) Interface from module not in optional_policy block (E-001)

CHECK IDS

	The following checks may be performed:

	X-001: Unused interface or template declaration
	X-002: AV rule with excluded source or target (can affect policy binary size)

	C-001: Violation of refpolicy te file ordering conventions
	C-004: Interface does not have documentation comment
	C-005: Permissions in av rule or class declaration not ordered
	C-006: Declarations in require block not ordered
	C-007: Redundant type specification instead of self keyword
	C-008: Conditional expression identifier from foreign module

	S-001: Require block used instead of interface call
	S-002: File context file labels with type not declared in module
	S-003: Unnecessary semicolon
	S-004: Template call from an interface
	S-005: Declaration in interface
	S-006: Bare module statement
	S-007: Call to gen_context omits mls component
	S-008: Unquoted gen_require block
	S-009: Permission macro suffix does not match class name
	S-010: Permission macro usage suggested

	W-001: Type or attribute referenced without explicit declaration
	W-002: Type, attribute or role used but not listed in require block in interface
	W-003: Unused type, attribute or role listed in require block
	W-004: Potentially unescaped regex character in file contexts paths
	W-005: Interface call from module not in optional_policy block
	W-006: Interface call with empty argument
	W-007: Unquoted space in argument of interface call
	W-008: Allow rule with complement or wildcard permission
	W-009: Module name does not match file name
	W-010: Call to unknown interface
	W-011: Declaration in require block not defined in own module
	W-012: Conditional expression contains unknown identifier
	W-013: Incorrect usage of audit_access permission

	E-002: Bad file context format
	E-003: Nonexistent user listed in fc file
	E-004: Nonexistent role listed in fc file
	E-005: Nonexistent type listed in fc file
	E-006: Declaration and interface with same name
	E-007: Usage of unknown permission or permission macro
	E-008: Usage of unknown class
	E-009: Empty optional or require macro block
	E-010: Usage of unknown simple m4 macro or stray word

	F-001: Policy syntax error prevents further processing
	F-002: Internal error in SELint