Re: [PATCH] libsepol: Check for invalid categories when expanding semantic levels

Stephen Smalley <[email protected]> Wed, 29 Jul 2026 16:23:51 -0400
Newsgroups org.kernel.vger.selinux
Message-ID <CAEjxPJ4DzDD65qb485L29v_eZRi6YZLR-oB8TPQMRrzfpZYfcA@mail.gmail.com>
On Wed, Jul 29, 2026 at 12:28 PM Stephen Smalley
<[email protected]> wrote:
>
> On Wed, Jul 29, 2026 at 11:43 AM James Carter <[email protected]> wrote:
> >
> > The function mls_semantic_level_expand() is used before the policy
> > has been validated. A maliciously crafted policy might have gaps in
> > the categories, so a check must be done to verify that the categories
> > referred to actually exist.
> >
> > Signed-off-by: James Carter <[email protected]>
>
> Acked-by: Stephen Smalley <[email protected]>

Merged.