drop two selinux policy dumps · diff booleans + modules + contexts · runs locally
semanage export · getsebool -a · semodule -l · file_contexts
post-incident or compromised host export for side-by-side diff
heuristic screener · dump format varies by RHEL/Fedora · field mapping approximate · not definitive proof