This Master thesis will design and implement an open-source tool that allows the administrator of a SELinux-secured system to see all the differences between the currently installed SELinux policy and the default policy provided by the distribution packages.



The output of this tool should be a report describing changes in policy modules (new, removed, and changed modules), customizations done via user-space tools (for example, context overrides, Boolean value changes) and manual modifications of policy files.



The tool should also include a framework for implementing analyses on the collected changes and a basic AVC (Access Vector Cache) denial message analysis as an example. This analysis should collect AVC denial messages recorded by the audit daemon and try to link them to the policy changes that cause the AVC denials.



The motivation behind this tool is to help security administrators with system maintenance and debugging of problems caused by changes in the SELinux policy.