Re: [PATCH v2] libsepol: add module package fuzzer

On Tue, Jul 21, 2026 at 3:41 PM Stephen Smalley
<[email protected]> wrote:
>
> On Tue, Jul 21, 2026 at 7:16 AM Petr Matyas <[email protected]> wrote:
> >
> > Add a libFuzzer target for the binary module package format
> > (.mod/.pp) read by sepol_module_package_read(). On a valid package,
> > also exercises sepol_module_package_to_cil() to cover the CIL
> > conversion path for module policies.
> >
> > The seed corpus contains a minimal module package produced by
> > checkmodule + semodule_package to give the fuzzer a structurally
> > correct starting point.
> >
> > Wire the new fuzzer into scripts/oss-fuzz.sh alongside the existing
> > libsepol and checkpolicy fuzzers.
> >
> > Signed-off-by: Petr Matyas <[email protected]>
>
> Acked-by: Stephen Smalley <[email protected]>

Merged. Would also suggest having it call sepol_module_package_info()
to exercise that code path.

>
> > ---
> >  libsepol/fuzz/min_mod.pp              | Bin 0 -> 859 bytes
> >  libsepol/fuzz/module-package-fuzzer.c |  47 ++++++++++++++++++++++++++
> >  scripts/oss-fuzz.sh                   |  11 ++++++
> >  3 files changed, 58 insertions(+)
> >  create mode 100644 libsepol/fuzz/min_mod.pp
> >  create mode 100644 libsepol/fuzz/module-package-fuzzer.c
> >
> > diff --git a/libsepol/fuzz/min_mod.pp b/libsepol/fuzz/min_mod.pp
> > new file mode 100644
> > index 0000000000000000000000000000000000000000..264bd4406bf94b1c0044d46d0ca82fcdc4716f88
> > GIT binary patch
> > literal 859
> > zcmb`FOA5k35Jbxl=uVd|J%Q*A+_=+~2MCyq;4dTjfQwu~Jg+OIFa^zEK*a~mbWhh*
> > zC(yS?b#DP+3;|pp)qMb9y%;ZdX?Yp1d{Q1=8^EZR_3@$y;IvDllTSJTW|Qf>?pS0_
> > zHBrrzoHHN0Jnz=6t<MgUaFAqvvv+Y3Wp+eUE^I&aR86ez;Ih;mqe31{=)Jy=*gJYM
> > z)YoZe5nJ0l^b4_C<_yiy`HMz`Zw0+SohO>SzP<k!{0FXMy?QKdaP72i-21Sn6|wj4
> > Fcmk%9EE)g+
> >
> > literal 0
> > HcmV?d00001
> >
> > diff --git a/libsepol/fuzz/module-package-fuzzer.c b/libsepol/fuzz/module-package-fuzzer.c
> > new file mode 100644
> > index 00000000..2516970b
> > --- /dev/null
> > +++ b/libsepol/fuzz/module-package-fuzzer.c
> > @@ -0,0 +1,47 @@
> > +#include <sepol/debug.h>
> > +#include <sepol/module.h>
> > +#include <sepol/module_to_cil.h>
> > +
> > +extern int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
> > +
> > +// set to 1 to enable more verbose libsepol logging
> > +#define VERBOSE 0
> > +
> > +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
> > +{
> > +       sepol_module_package_t *mod = NULL;
> > +       struct sepol_policy_file *spf = NULL;
> > +       FILE *devnull = NULL;
> > +
> > +       sepol_debug(VERBOSE);
> > +
> > +       if (sepol_policy_file_create(&spf))
> > +               goto exit;
> > +
> > +       sepol_policy_file_set_mem(spf, (char *)data, size);
> > +
> > +       if (sepol_module_package_create(&mod))
> > +               goto exit;
> > +
> > +       if (sepol_module_package_read(mod, spf, VERBOSE))
> > +               goto exit;
> > +
> > +       devnull = fopen("/dev/null", "we");
> > +       if (!devnull)
> > +               goto exit;
> > +
> > +       /* sepol_module_package_read() stores contexts sections as raw blobs
> > +        * without validating their text syntax; sepol_module_package_to_cil()
> > +        * is the first place that parses them, so a graceful error return here
> > +        * is expected behaviour for malformed input, not a bug. */
> > +       (void)sepol_module_package_to_cil(devnull, mod);
> > +
> > +exit:
> > +       if (devnull)
> > +               fclose(devnull);
> > +       sepol_module_package_free(mod);
> > +       sepol_policy_file_free(spf);
> > +
> > +       /* Non-zero return values are reserved for future use. */
> > +       return 0;
> > +}
> > diff --git a/scripts/oss-fuzz.sh b/scripts/oss-fuzz.sh
> > index 9376b6e4..08e06975 100755
> > --- a/scripts/oss-fuzz.sh
> > +++ b/scripts/oss-fuzz.sh
> > @@ -74,6 +74,17 @@ $CXX $CXXFLAGS $LIB_FUZZING_ENGINE binpolicy-fuzzer.o "$DESTDIR/usr/lib/libsepol
> >
> >  zip -j "$OUT/binpolicy-fuzzer_seed_corpus.zip" libsepol/fuzz/policy.bin
> >
> > +## module package fuzzer ##
> > +
> > +# CFLAGS, CXXFLAGS and LIB_FUZZING_ENGINE have to be split to be accepted by
> > +# the compiler/linker so they shouldn't be quoted
> > +# shellcheck disable=SC2086
> > +$CC $CFLAGS -c -o module-package-fuzzer.o libsepol/fuzz/module-package-fuzzer.c
> > +# shellcheck disable=SC2086
> > +$CXX $CXXFLAGS $LIB_FUZZING_ENGINE module-package-fuzzer.o "$DESTDIR/usr/lib/libsepol.a" -o "$OUT/module-package-fuzzer"
> > +
> > +zip -j "$OUT/module-package-fuzzer_seed_corpus.zip" libsepol/fuzz/min_mod.pp
> > +
> >  ## checkpolicy fuzzer ##
> >
> >  make -C checkpolicy clean
> > --
> > 2.55.0
> >
> >