Re: [RFC/Discussion] eBPF-based runtime permission auditing tool for SELinux policies

On Tue, Aug 18, 2026 at 6:52 PM rushikesh ghatpande
<[email protected]> wrote:
>
> Hi Stephen,
>
> Thank you for taking a look, and for the context on the
> auditallow/Android precedent. It is a helpful confirmation that the
> runtime-observation angle is worth pursuing via a different mechanism.
>
> It would be an honor to have this considered for the SELinuxProject
> GitHub. I'd also like to be an active contributor to the SELinux space
> more broadly, not just with this one tool. I see this as a starting
> point.
>
> On coupling: the eBPF side hooks avc_has_perm(), plus a few more
> targeted LSM hooks (selinux_file_open, selinux_mmap_file,
> selinux_inode_getattr). This is done via BCC. There's no dependency on
> libselinux, libsepol, or policycoreutils here.
>
> On the policy side, it currently shells out to sesearch (setools) to
> extract allow rules for a given context. So there is a dependency on
> setools, but not on the core userspace tree itself.
>
> Given that, I'd lean toward a standalone repo for now. It sits next to
> the existing tree, not inside it. I'm open to your view on where the
> right boundary is.
>
> I'm happy to keep improving it based on feedback. If there's anything
> specific you'd like me to change or look at, let me know.

Just for future reference - for public mailing lists the convention is
to post your reply after the
message to which you are responding (interleaving your responses with snippets
to which you replying and pruning any part of the previous message
that isn't relevant to
your reply). Not a big deal for this thread so far but helps ensure
that people can read comments
in context and avoid wasting space for the complete previous email
since it is already in the
archive.

Sounds like keeping it as a separate repo is the right move and we can
see whether other
developers and users find it to be helpful for their workflows. If so,
happy to consider it for
SELinuxProject in the future. Thanks again for sharing it.