Re: [PATCH] libsepol: Check for invalid categories when expanding semantic levels
Stephen Smalley <[email protected]> Wed, 29 Jul 2026 16:23:51 -0400
| Newsgroups | org.kernel.vger.selinux |
|---|---|
| Message-ID | <CAEjxPJ4DzDD65qb485L29v_eZRi6YZLR-oB8TPQMRrzfpZYfcA@mail.gmail.com> |
On Wed, Jul 29, 2026 at 12:28 PM Stephen Smalley <[email protected]> wrote: > > On Wed, Jul 29, 2026 at 11:43 AM James Carter <[email protected]> wrote: > > > > The function mls_semantic_level_expand() is used before the policy > > has been validated. A maliciously crafted policy might have gaps in > > the categories, so a check must be done to verify that the categories > > referred to actually exist. > > > > Signed-off-by: James Carter <[email protected]> > > Acked-by: Stephen Smalley <[email protected]> Merged.