Re: [PATCH v2] libselinux: prevent ReDoS in file context regex matching

On Thu, Jul 30, 2026 at 5:11 AM Petr Matyas <[email protected]> wrote:
>
> The PCRE2 interpreter is susceptible to catastrophic backtracking on
> crafted file context patterns or lookup keys. Since libselinux never
> called pcre2_jit_compile(3) or pcre2_jit_match(3), the JIT was
> available but unused, leaving the interpreter exposed on all platforms.
>
> Fix with two complementary mitigations:
>
> 1. Call pcre2_jit_compile() after every pattern compilation (including
>    mmap deserialization) to engage JIT for both complete and partial
>    matching. regex_match() now calls pcre2_jit_match() and falls back to
>    pcre2_match() only on PCRE2_ERROR_JIT_BADOPTION (JIT unavailable or
>    not compiled for the requested mode).
>
> 2. Create a shared pcre2_match_context with a backtrack step limit of
>    10 000 000 and pass it to both pcre2_jit_match() and the fallback
>    pcre2_match(). PCRE2_ERROR_MATCHLIMIT is treated as no-match to keep
>    the lookup safe rather than failing noisily. This bounds worst-case
>    matching time to milliseconds for any pattern/subject combination,
>    regardless of JIT availability.
>
> The vulnerability was reproduced and confirmed fixed on:
> - RHIVOS 2.0 / aarch64
> - RHEL 10.3 / x86_64
> - Fedora 44 / x86_64
>
> Reproducer (149 bytes, base64):
> AwovMi0GLy8GCygKeAYGKwYLKAoKCgAAAPpXKgsoCi8vBgs8PG5vbmU+PgovMi0GLy8GCygKeAYG
> KwYLKAoKCiNXLy8wCwsoCgojV1dXClcqCygKLy8vV1cueHhXV1d4eHgveCsGCygKCgonVy9XV3cy
> eHgveAcGJAsoCi8tLwYvMi0GLy8GCzw8bm9uZT4+3q2+7y8=
>
> Signed-off-by: Petr Matyas <[email protected]>
>
> libsepol/cil: Return SEPOL_ERR on failure to set bit
>
> The functions cil_typepermissive_to_policydb() and
> cil_typeneveraudit_to_policydb() return rc when ebitmap_set_bit()
> fails, but the rc value at the point is SEPOL_OK.

Something went wrong with your commit message - seemingly
squashed/merged with another one.
Also with this patch applied, I get a selinux-testsuite failure, see
below for just running the individual
failing test:
$ cd selinux-testsuite
$ sudo make -C policy load
$ sudo ./tests/file_contexts/test
ok 1
internal.c:assertContextsMatch:24 Lookup for /base/unkown from
test_lookup failed (No such file or directory)
not ok 2
#   Failed test at ./tests/file_contexts/test line 27.
ok 3
./tests/file_contexts/f1.fc: line 1 has invalid context
system_u:object_r:rootfs:s0
./tests/file_contexts/f1.fc: line 1 has invalid context
system_u:object_r:rootfs:s0
ok 4
./tests/file_contexts/f1.fc: line 1 has invalid context
system_u:object_r:rootfs:s0
./tests/file_contexts/f1.fc: line 1 has invalid context
system_u:object_r:rootfs:s0
ok 5
# Looks like you failed 1 test of 5.