<commit_before>AN OVERVIEW OF TWO TYPES RELATIONSHIP ANALYSIS
apol, version 1.6
December 18, 2004
<EMAIL>


Apol allows one to analyze an SELinux policy to understand the relationship 
between two specific types that are defined in the policy. Policy developers 
may want to know if there exists any relationship (or interactions) between 
typeA and typeB and exactly what makes up that relationship (i.e., what rules, 
permissions, attributes, roles, etc. exist that cause or allow interactions 
between the two types). Or they may want to determine whether a particular 
type is completely isolated from another. This analysis can also be used as a 
stepping stone to analyzing dependencies within a policy. For example, one may 
want to determine whether typeA is dependent upon typeB or vice versa. Does typeA 
need to write to typeB or read from typeB to perform its' duties? What happens 
if typeA is removed from the policy?

Additional questions that this type of analysis may answer include: Are both 
types assigned to a common attribute or role? What users have access to this 
attribute and under what roles? What common object types do the types in 
question need to access? What makes them similar? What makes them unique, 
thus needing a separate type defined? How do the types, particularly domains, 
interact with each other; through process signaling or through a more complex 
interprocess communication (IPC) mechanism? Do the two types share any data 
and if so, how does information move from one domain to another?


UNDERSTANDING THE RELATIONSHIP BETWEEN TWO TYPES

When discussing the relationship between two types, the following aspects 
need to be determined:

  - the attribute(s) to which both types are assigned (common attribs) 
  - the role(s) which have access to both TypeA and TypeB (common roles)
  - the users which have access to both TypeA and TypeB (common users) 
  - all type transition rules from TypeA to TypeB or from TypeB  
    to TypeA. 
  - any process interactions between TypeA and TypeB (e.g., allow rules that   
    allow TypeA and TypeB to send signals to each other).  
  - object types to which both types are granted access. 
  - the unique object types to which TypeA and TypeB have access. 
  - any direct information flows between TypeA and TypeB (see "Information 
    Flow Analysis" under the Help menu) 
  - any transitive information flows between TypeA and TypeB (see "Information 
    Flow Analysis" under the Help menu) 
  - any domain transitions from TypeA to TypeB or from TypeB to TypeA. 
    (see "Domain  Transition Analysis" under the Help menu) 
    
This analysis may contain an overwhelming amount of information, so the results 
are simplified by listing each aspect of the analysis as a separate element 
within the listbox. This allows the user to select any aspect of the analysis 
from the listbox and have that specific information displayed within the results 
textbox. If desired, all results can be displayed at once by selecting the listbox 
item labeled 'Show All Results'.
	<commit_msg>Updated help<commit_after>AN OVERVIEW OF TYPES RELATIONSHIP SUMMARY ANALYSIS
apol, version 1.6
January 28, 2005
<EMAIL>


Apol allows one to analyze an SELinux policy in order to understand the relationship 
between two specific types that are defined in the policy. Policy developers 
may want to know if there exists any relationship (or interactions) between 
typeA and typeB and exactly what makes up that relationship (i.e., what rules, 
permissions, attributes, roles, etc. exist that cause or allow interactions 
between the two types). Or they may want to determine whether a particular 
type is completely isolated from another. This analysis can also be used as a 
stepping stone to analyzing dependencies within a policy. For example, one may 
want to determine whether typeA is dependent upon typeB or vice versa. Does typeA 
need to write to typeB or read from typeB to perform its' duties? What happens 
if typeA is removed from the policy?

Additional questions that this type of analysis may answer include: Are both 
types assigned to a common attribute or role? What users have access to this 
type/attribute through a common role? What common object types do the types in 
question access? What makes them similar? What makes them unique, thus needing 
a separate type defined? How do the types, particularly domains, interact with 
each other; through process signaling or through a more complex interprocess 
communication (IPC) mechanism? Do the two types share any data and if so, how 
does information move from one domain to another?


UNDERSTANDING THE RESULTS OF A TYPES RELATIONSHIP SUMMARY ANALYSIS

Basically, the results consist of a summary of output from all of the analysis 
modules and other queries provided in apol using the two specified types as 
input. A more experienced apol user, should be able to perform the analyses 
on his or her own, However, this module is available to provide a convenient 
and efficient way to summarize the relationship between two types. The results
of this analysis consist of:

	- the attribute(s) to which both types are assigned (common attribs) 
	- the role(s) which have access to both TypeA and TypeB (common roles) 
	- the users which have access to both TypeA and TypeB through a common
	  role. (common users) 
	- all type transition/change rules from TypeA to TypeB or vice versa.
	- all allow rules that provide access between TypeA and TypeB 
	  (e.g., allow rules that allow TypeA and TypeB to send signals to each other). 
	- types to which both TypeA and TypeB have common access. 
	- types to which TypeA and TypeB have dissimilar access.
	- any direct information flows between TypeA and TypeB 
	- any transitive information flows between TypeA and TypeB
	- any domain transitions from TypeA to TypeB or vice versa. 
	
This analysis may contain an overwhelming amount of information, so the results
are simplified by listing each aspect of the analysis as a separate child element 
within a tree widget. This allows the user to select any aspect of the analysis 
from the tree and have more specific results displayed within the textbox. 
    
	
{'fraction_non_alphanumeric': 0.02930756843800322, 'fraction_numerical': 0.0025764895330112722, 'mean_word_length': 4.1119341563786005, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5308030', 'n_tokens_mistral': 1569, 'n_tokens_neox': 1485, 'n_words': 974}