Re: [PATCH] libsepol/fuzz: Validate output of expand_module() before proceeding
Stephen Smalley <[email protected]> Mon, 3 Aug 2026 16:18:26 -0400
| Newsgroups | org.kernel.vger.selinux |
|---|---|
| Message-ID | <CAEjxPJ6376BUuLtb3pEYNzUZZfK7_TEOd89Cd_O6Hd1xB7SgfQ@mail.gmail.com> |
On Mon, Aug 3, 2026 at 12:35=E2=80=AFPM Stephen Smalley <[email protected]> wrote: > > On Mon, Aug 3, 2026 at 11:47=E2=80=AFAM James Carter <[email protected]> = wrote: > > > > When creating actual policies the output of expand_module() is > > written to disk. Converting that policy to CIL or performing other > > operations on it will require it to be read by policydb_read() which > > calls policydb_validate(). The fuzzer is not validating the policy, > > so it is reporting bugs that would be caught by validation. > > > > Have the fuzzer call policydb_validate() after expanding modules > > so it will not report bugs that are caught by validation. > > > > Signed-off-by: James Carter <[email protected]> > > Acked-by: Stephen Smalley <[email protected]> Merged.