Chapter 13

1. The seinfo application is used to query the policy for its type content, but not for its rules. For instance, you list the types within the policy with seinfo, but you don't query what these types can do.

   The sesearch application, on the other hand, is used to query the rules within the policy, but does not reveal anything about the various definitions inside the policy that are not really rules (such as attribute definitions and supported classes).

   Hence, the main difference is that seinfo focuses on the structure of the policy, whereas sesearch focuses on the enforcements defined within the policy.

2. Reaching a domain implies domain transitions. Hence, what we are looking for is how you can transition from your current domain (say staff_t) to the target domain (say unconfined_t) and through which means—generally, this is done by executing a binary or script that triggers a type transition.

   Analyzing domain transitions can be done using apol (the graphical...