[PATCH v2] libsepol: reject policies with no avtab entries in expand_module()

avtab_read() already rejects policies that have no avtab entries in
both libsepol and the kernel, but expand_module() can produce a
policydb that has none. Check and reject such policies in
expand_module() so that checkpolicy (and its fuzzer) will fail rather
than writing out an invalid binary policy.

Update the libsepol test-expander policies to include at least one av
rule so that they produce at least one avtab entry.

Reported-by: oss-fuzz (issue 541553475)
Signed-off-by: Stephen Smalley <[email protected]>
---
 libsepol/src/expand.c                                     | 5 +++++
 libsepol/tests/policies/test-expander/alias-base.conf     | 3 +++
 libsepol/tests/policies/test-expander/base-base-only.conf | 2 ++
 libsepol/tests/policies/test-expander/role-base.conf      | 3 +++
 libsepol/tests/policies/test-expander/user-base.conf      | 3 +++
 5 files changed, 16 insertions(+)

diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
index 8cb62d82..466d5bc1 100644
--- a/libsepol/src/expand.c
+++ b/libsepol/src/expand.c
@@ -3494,6 +3494,11 @@ int expand_module(sepol_handle_t *handle, policydb_t *base, policydb_t *out,
 		goto cleanup;
 	}
 
+	if (out->te_avtab.nel == 0) {
+		ERR(handle, "avtab must contain at least one entry");
+		goto cleanup;
+	}
+
 	/* copy constraints */
 	if (hashtab_map(state.base->p_classes.table, constraint_copy_callback,
 			&state)) {
diff --git a/libsepol/tests/policies/test-expander/alias-base.conf b/libsepol/tests/policies/test-expander/alias-base.conf
index 34955924..36016e64 100644
--- a/libsepol/tests/policies/test-expander/alias-base.conf
+++ b/libsepol/tests/policies/test-expander/alias-base.conf
@@ -420,6 +420,9 @@ type alias_check_1_t;
 type alias_check_2_t;
 type alias_check_3_t;
 
+# Need at least one av rule
+allow alias_check_1_t self:process fork;
+
 typealias alias_check_1_t alias alias_check_1_a;
 
 optional {
diff --git a/libsepol/tests/policies/test-expander/base-base-only.conf b/libsepol/tests/policies/test-expander/base-base-only.conf
index 4eae73ea..6657c532 100644
--- a/libsepol/tests/policies/test-expander/base-base-only.conf
+++ b/libsepol/tests/policies/test-expander/base-base-only.conf
@@ -34,6 +34,8 @@ mlsconstrain file { read }
 
 attribute myattr;
 type mytype_t;
+# Need at least one av rule
+allow mytype_t self:file read;
 role myrole_r;
 role myrole_r types mytype_t;
 bool mybool true;
diff --git a/libsepol/tests/policies/test-expander/role-base.conf b/libsepol/tests/policies/test-expander/role-base.conf
index a387c8c0..57efe2c5 100644
--- a/libsepol/tests/policies/test-expander/role-base.conf
+++ b/libsepol/tests/policies/test-expander/role-base.conf
@@ -418,6 +418,9 @@ type role_check_1_1_t;
 role role_check_1;
 role role_check_1 types role_check_1_1_t;
 
+# Need at least one av rule
+allow role_check_1_1_t self:process fork;
+
 ########
 type fs_t;
 type system_t;
diff --git a/libsepol/tests/policies/test-expander/user-base.conf b/libsepol/tests/policies/test-expander/user-base.conf
index 789a59a2..05827b09 100644
--- a/libsepol/tests/policies/test-expander/user-base.conf
+++ b/libsepol/tests/policies/test-expander/user-base.conf
@@ -421,6 +421,9 @@ role user_check_1_2_r;
 role user_check_1_1_r types user_check_1_1_t;
 role user_check_1_2_r types user_check_1_2_t;
 
+# Need at least one av rule
+allow user_check_1_1_t self:process fork;
+
 ########
 type fs_t;
 type system_t;
-- 
2.55.0