• Add initial prompts to MCP server.
• Add file_contexts querying class.
• Change MCP server to use standalone FastMCP package. The FastMCP server in
  the mcp package is a legacy version. FastMCP depends on the mcp package, so
  this change is not expected to be problematic for users or distros.

Notable Changes

• Add MCP server to provide LLMs the ability to analyze policy.
• The source distribution is now a Python sdist and can be installed
  using pip.

Notes

• Since the source distribution is Python sdist, the policyrep C extension is already cythonized. Cython is not needed unless you want to regenerate the C code. However, because of the generated code, the source distribution is much larger.

User Visible Changes

• Add seinfo option to see roles allowed for a specified type.
• Add sechecker module for asserting kernel modules are read-only.
• Add support for the nlmsg extended permission.

Under The Hood Changes

• Significant code quality and unit testing improvements.
• Drop methods marked for deprecation.

Packaging Changes

• Refactor packaging to use pyproject.toml.

• Correct annotations of NetworkX types to make it optional again.
• Fix packaging issue for apol's style sheet (apol.css).

User Visible Changes

• Add graphical results for information flow analysis and domain
  transition analysis, available in apol, sedta, and seinfoflow.
• Add tooltips, What's This?, and detail popups in apol to help
  cross-referencing query and analysis results along with
  context-sensitive help.

Under The Hood Changes

• Rework apol to fully generate the UI programmatically.
• Update apol to PyQt6
• Replace deprecated uses of pkg_resources and distutils.
• Begin adding unit tests for apol UI.

Updated Dependencies

SETools now higher minimum versions of the following dependencies:

• Python 3.10
• NetworkX 2.6
• PyQt6
• Cython 0.29.14

New Dependencies

• pygraphviz (for seinfoflow, sedta, apol)
• pytest (if running unit tests)

• Update for compiling with libsepol 3.6.
• Update apol to use fully specified PyQt enums.
• Correct minor code lint issues.

• Fix compilation with Cython 3.0.0.
• Improve man pages.
• Remove neverallow options in sediff.
• Add -r option to seinfoflow to get flows into the source type.
• Reject a rule with no permissions as invalid policy.

• Make NetworkX optional. sedta and seinfoflow tools, along with the
  equivalent analyses in apol require NetworkX.
• Change unit test runner to pytest as setuptools' test command is
  deprecated.
• Remove neverallow options in sesearch and apol. These are not usable
  since they are removed in the final binary policy.
• Unit tests and CI tests improvements.

• Replace deprecated NetworkX function use in information flow and domain
  transition analysis. This function was removed in NetworkX 3.0.
• Fix bug in apol copy and cut functions when copying from a tree view.
• Fix bug with extended permission set construction when a range includes
  0x0.
• Add sesearch -Sp option for permission subset match.
• Fix error in man page description for sesearch -ep option.
• Improve output stability in constraint, common, class, role, and user
  queries.
• Updated permission map.
• Fix bug in sechecker parsing of multiline values.
• Other code cleanups not visible to users.

This SETools requires Python 3.6+ and libsepol 3.2+

User Visible Changes

• Added support for old Boolean name substitution in seinfo and sesearch.
• Added sechecker tool which is a configuration file driven analysis tool.

Development Related Changes

• Updated policy representation to handle policydb version 33, compressed
  filename transitions.
• Changed apol tab registry to use metaclasses rather than having a multiple static
  dictionaries in the code.
• Fixed bug in queries where checks that permissions were part of the specified
  object class would incorrectly raise exceptions when the object class
  criteria is a regex.
• Added type annotations to the code and added static type checking for
  continuous integration tests.
• Reduced aggressiveness of default compiler flags. Since the C code is generated
  by Cython, there typically isn't anything SETools can do when Cython causes
  compiler warnings.