Re: [PATCH] libsepol: Check for zero when mapping identifier values
Stephen Smalley <[email protected]> Fri, 31 Jul 2026 16:05:12 -0400
| Newsgroups | org.kernel.vger.selinux |
|---|---|
| Message-ID | <CAEjxPJ5ASW_E1xgzHu-yX6JBLjwXfh-XuGS5S+PcWz2SOjOQeQ@mail.gmail.com> |
On Fri, Jul 31, 2026 at 3:26=E2=80=AFPM Stephen Smalley <[email protected]> wrote: > > On Fri, Jul 31, 2026 at 1:51=E2=80=AFPM James Carter <[email protected]> = wrote: > > > > When expanding a base along with its modules, the identifier values > > of declarations are mapped from their values in the module to their > > values in the kernel policy. A maliciously crafted policy could > > create a situation where there is no mapping. This would leave the > > new identifier value as zero. Identifier values must start at 1 > > because "value - 1" is used to reference zero-based arrays. > > > > Signed-off-by: James Carter <[email protected]> > > Acked-by: Stephen Smalley <[email protected]> Merged.