Re: [PATCH] selinux: validate constraint expression attr and op at load time

On Jul 27, 2026 Stephen Smalley <[email protected]> wrote:
> 
> read_cons_helper() validates the expression type and stack depth
> of each constraint node but leaves e->attr and e->op unchecked,
> so a policy with an invalid operator or attribute value is
> accepted at load and only detected when the constraint is evaluated.
> constraint_expr_eval() handles such unrecognized cases with BUG()
> so the first permission check that reaches such a node oopses in
> the context of the checking process or panics with panic_on_oops.
> 
> Reject these expresssions when the policy is loaded, matching what
> the libsepol validator already does.
> 
> Signed-off-by: Stephen Smalley <[email protected]>
> ---
>  security/selinux/ss/policydb.c | 35 ++++++++++++++++++++++++++++++++++
>  1 file changed, 35 insertions(+)

Merged into selinux/dev, thanks.

--
paul-moore.com