Re: [PATCH] libsepol: add module package fuzzer

On Mon, Jul 20, 2026 at 7:07 AM Petr Matyas <[email protected]> wrote:
>
> Add a libFuzzer target for the binary module package format
> (.mod/.pp) read by sepol_module_package_read(). On a valid package,
> also exercises sepol_module_package_to_cil() to cover the CIL
> conversion path for module policies.
>
> The seed corpus contains a minimal module package produced by
> checkmodule + semodule_package to give the fuzzer a structurally
> correct starting point.
>
> Wire the new fuzzer into scripts/oss-fuzz.sh alongside the existing
> libsepol and checkpolicy fuzzers.
>
> Signed-off-by: Petr Matyas <[email protected]>
> ---
>  libsepol/fuzz/min_mod.pp              | Bin 0 -> 859 bytes
>  libsepol/fuzz/module-package-fuzzer.c |  44 ++++++++++++++++++++++++++
>  scripts/oss-fuzz.sh                   |  11 +++++++
>  3 files changed, 55 insertions(+)
>  create mode 100644 libsepol/fuzz/min_mod.pp
>  create mode 100644 libsepol/fuzz/module-package-fuzzer.c

> diff --git a/libsepol/fuzz/module-package-fuzzer.c b/libsepol/fuzz/module-package-fuzzer.c
> new file mode 100644
> index 00000000..18d645bb
> --- /dev/null
> +++ b/libsepol/fuzz/module-package-fuzzer.c
> @@ -0,0 +1,44 @@
> +#include <sepol/debug.h>
> +#include <sepol/module.h>
> +#include <sepol/module_to_cil.h>
> +
> +extern int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
> +
> +// set to 1 to enable more verbose libsepol logging
> +#define VERBOSE 0
> +
> +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
> +{
> +       sepol_module_package_t *mod = NULL;
> +       struct sepol_policy_file *spf = NULL;
> +       FILE *devnull = NULL;
> +
> +       sepol_debug(VERBOSE);
> +
> +       if (sepol_policy_file_create(&spf))
> +               goto exit;
> +
> +       sepol_policy_file_set_mem(spf, (char *)data, size);
> +
> +       if (sepol_module_package_create(&mod))
> +               goto exit;
> +
> +       if (sepol_module_package_read(mod, spf, VERBOSE))
> +               goto exit;
> +
> +       devnull = fopen("/dev/null", "we");
> +       if (!devnull)
> +               goto exit;
> +
> +       if (sepol_module_package_to_cil(devnull, mod))
> +               abort();

Do we want it to abort if there was garbage in the .fc file or other
*_contexts files?
sepol_module_package_read() only parses the binary module and extracts the raw
contents of the contexts files but doesn't try to parse them, so the
error won't show up
until we try to convert to CIL.

> +
> +exit:
> +       if (devnull)
> +               fclose(devnull);
> +       sepol_module_package_free(mod);
> +       sepol_policy_file_free(spf);
> +
> +       /* Non-zero return values are reserved for future use. */
> +       return 0;
> +}