Re: [PATCH v2] libsepol: log an error if we hit the max depth for __evaluate_classperms_list()

On Mon, Aug 3, 2026 at 4:10 PM Stephen Smalley
<[email protected]> wrote:
>
> Add a cil_log() statement so that we do not fail silently if we hit
> the max depth. While we are here, introduce a #define for the max
> depth and use it, and fix the comparison so that we fail immediately
> when the depth has already reached the limit.
>
> Signed-off-by: Stephen Smalley <[email protected]>

Acked-by: James Carter <[email protected]>

> ---
> v2 adds the missing newline to cil_log(); was confused by the
> fact that cil_tree_log() doesn't want one but cil_log() does.
>
>  libsepol/cil/src/cil_post.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/libsepol/cil/src/cil_post.c b/libsepol/cil/src/cil_post.c
> index 183b0d49..b9d5696f 100644
> --- a/libsepol/cil/src/cil_post.c
> +++ b/libsepol/cil/src/cil_post.c
> @@ -49,6 +49,8 @@
>  #include "cil_symtab.h"
>  #include "cil_deny.h"
>
> +#define MAX_CLASSPERMS_DEPTH (32)
> +
>  #define GEN_REQUIRE_ATTR \
>         "cil_gen_require" /* Also in libsepol/src/module_to_cil.c */
>  #define TYPEATTR_INFIX "_typeattr_" /* Also in libsepol/src/module_to_cil.c */
> @@ -2296,8 +2298,11 @@ static int __evaluate_classperms_list(struct cil_list *classperms,
>         int rc = SEPOL_ERR;
>         struct cil_list_item *curr;
>
> -       if (depth > 32)
> +       if (depth >= MAX_CLASSPERMS_DEPTH) {
> +               cil_log(CIL_ERR, "Exceeded max classperms depth (%u)\n",
> +                       MAX_CLASSPERMS_DEPTH);
>                 return SEPOL_ERR;
> +       }
>
>         cil_list_for_each(curr, classperms) {
>                 if (curr->flavor == CIL_CLASSPERMS) {
> --
> 2.55.0
>