Re: [PATCH] libsepol/fuzz: Exercise module to CIL code when fuzzing

On Thu, Jul 30, 2026 at 10:39=E2=80=AFAM James Carter <[email protected]> w=
rote:
>
> When fuzzing a kernel policy both sepol_kernel_policydb_to_conf()
> and sepol_kernel_policydb_to_cil() are called to test those parts
> of the code base. Call sepol_module_policydb_to_cil() for base and
> module policies to test that part of the code base.
>
> Signed-off-by: James Carter <[email protected]>
> ---
>  libsepol/fuzz/binpolicy-fuzzer.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/libsepol/fuzz/binpolicy-fuzzer.c b/libsepol/fuzz/binpolicy-f=
uzzer.c
> index c0d96d8f..fd9dec91 100644
> --- a/libsepol/fuzz/binpolicy-fuzzer.c
> +++ b/libsepol/fuzz/binpolicy-fuzzer.c
> @@ -72,8 +72,12 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t=
 size)
>
>                 if (sepol_kernel_policydb_to_cil(devnull, &policydb))
>                         abort();
> +       } else {
> +               if (sepol_module_policydb_to_cil(devnull, &policydb, 0))
> +                       abort();
> +       }

Missing #include <sepol/module_to_cil.h> which breaks ./scripts/oss-fuzz.sh=
:
libsepol/fuzz/binpolicy-fuzzer.c:76:7: error: call to undeclared function
      'sepol_module_policydb_to_cil'; ISO C99 and later do not support impl=
icit
      function declarations [-Wimplicit-function-declaration]
   76 |                 if (sepol_module_policydb_to_cil(devnull, &policydb=
, 0))
      |                     ^
libsepol/fuzz/binpolicy-fuzzer.c:76:7: note: did you mean
      'sepol_kernel_policydb_to_cil'?
/DESTDIR/usr/include/sepol/kernel_to_cil.h:5:5: note:
      'sepol_kernel_policydb_to_cil' declared here
    5 | int sepol_kernel_policydb_to_cil(FILE *out, struct policydb *pdb);
      |     ^