Re: [PATCH v2] libsepol/fuzz: Exercise module to CIL code when fuzzing

On Fri, Jul 31, 2026 at 11:26=E2=80=AFAM James Carter <[email protected]> w=
rote:
>
> When fuzzing a kernel policy both sepol_kernel_policydb_to_conf()
> and sepol_kernel_policydb_to_cil() are called to test those parts
> of the code base. Call sepol_module_policydb_to_cil() for base and
> module policies to test that part of the code base.
>
> Signed-off-by: James Carter <[email protected]>

Acked-by: Stephen Smalley <[email protected]>

> ---
> v2: Add include for module_to_cil.h
>     Move the whole if statement for POLICY_BASE into the else block with
>       the sepol_module_policydb_to_cil() call to make it clearer what is
>       being done for kernel, base, and module policies.
>
>  libsepol/fuzz/binpolicy-fuzzer.c | 39 ++++++++++++++++++--------------
>  1 file changed, 22 insertions(+), 17 deletions(-)
>
> diff --git a/libsepol/fuzz/binpolicy-fuzzer.c b/libsepol/fuzz/binpolicy-f=
uzzer.c
> index c0d96d8f..017f996e 100644
> --- a/libsepol/fuzz/binpolicy-fuzzer.c
> +++ b/libsepol/fuzz/binpolicy-fuzzer.c
> @@ -1,6 +1,7 @@
>  #include <sepol/debug.h>
>  #include <sepol/kernel_to_cil.h>
>  #include <sepol/kernel_to_conf.h>
> +#include <sepol/module_to_cil.h>
>  #include <sepol/policydb/expand.h>
>  #include <sepol/policydb/hierarchy.h>
>  #include <sepol/policydb/link.h>
> @@ -72,30 +73,34 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_=
t size)
>
>                 if (sepol_kernel_policydb_to_cil(devnull, &policydb))
>                         abort();
> +       } else {
> +               if (sepol_module_policydb_to_cil(devnull, &policydb, 0))
> +                       abort();
>
> -       } else if (policydb.policy_type =3D=3D POLICY_BASE) {
> -               if (link_modules(NULL, &policydb, NULL, 0, VERBOSE))
> -                       goto exit;
> +               if (policydb.policy_type =3D=3D POLICY_BASE) {
> +                       if (link_modules(NULL, &policydb, NULL, 0, VERBOS=
E))
> +                               goto exit;
>
> -               if (policydb_init(&out))
> -                       goto exit;
> +                       if (policydb_init(&out))
> +                               goto exit;
>
> -               if (expand_module(NULL, &policydb, &out, VERBOSE,
> -                                 /*check_assertions=3D*/0))
> -                       goto exit;
> +                       if (expand_module(NULL, &policydb, &out, VERBOSE,
> +                                         /*check_assertions=3D*/0))
> +                               goto exit;
>
> -               (void)check_assertions(NULL, &out,
> -                                      out.global->branch_list->avrules);
> -               (void)hierarchy_check_constraints(NULL, &out);
> +                       (void)check_assertions(
> +                               NULL, &out, out.global->branch_list->avru=
les);
> +                       (void)hierarchy_check_constraints(NULL, &out);
>
> -               if (write_binary_policy(&out, devnull))
> -                       abort();
> +                       if (write_binary_policy(&out, devnull))
> +                               abort();
>
> -               if (sepol_kernel_policydb_to_conf(devnull, &out))
> -                       abort();
> +                       if (sepol_kernel_policydb_to_conf(devnull, &out))
> +                               abort();
>
> -               if (sepol_kernel_policydb_to_cil(devnull, &out))
> -                       abort();
> +                       if (sepol_kernel_policydb_to_cil(devnull, &out))
> +                               abort();
> +               }
>         }
>
>  exit:
> --
> 2.55.0
>