$ sesearch -A -s some_app_t -c file -p read -p write
allow some_app_t some_type_t:file { read write };
allow some_app_t some_other_type_t:file { read write };
allow some_attribute_of_some_app_t yet_another_type_t:file { read write };
Or, say you want to do the opposite – you know the label, and want to find all domains that can read and write it: $ sesearch -A -t some_type_t -c file -p read -p write
allow some_app_t some_type_t:file { read write };
allow some_other_app_t some_type_t:file { read write };
You can use regexes for the parameters if you don't know the exact types (just specify '-r[stcdb]'). $ egrep '^(model name|microcode)' /proc/cpuinfo | head -n2
model name : Intel(R) Core(TM) i7-6820HQ CPU @ 2.70GHz
microcode : 0x9e
$ egrep -o ' (hle|rtm) ' /proc/cpuinfo | head -n2
hle
rtm
This is a mobile chip and an old stepping (and running the microcode that supposedly addresses the issue, presumably by disabling it on 'bad' chips?), so I'd be surprised if newer chips (especially server ones) didn't have it.
I flashed my Skylake laptop a few days ago, and now I'm on microcode rev 0xc2 (versus 0xba in the latest Intel tarball). CPUID output suggests IBRS support (according to [1]).
[1] https://patchwork.kernel.org/patch/10147547/