Re: [PATCH] libsepol: Non-mls polcies should not have any levels

On Tue, Aug 4, 2026 at 2:25 PM James Carter <[email protected]> wrote:
>
> A maliciously crafted non-mls policy could still have levels in it.
> There is no validation of levels for a non-mls policy which could
> cause a problem if those levels are processed somewhere in libsepol.
>
> A non-mls policy should have no entries in the level symbol table,
> so check that the symbol table is empty when validating and return
> an error if it is not.
>
> Signed-off-by: James Carter <[email protected]>

Triggers a test failure in libsepol:
Suite: downgrade
  Test: downgrade ...error reading policy binary, version 34
(downgraded from 35)

Error during downgrade testing of Non-MLS policy
FAILED
    1. test-downgrade.c:183  - CU_FAIL("Unable to read downgraded
binary policy")

Also typo in the subject line (polcies).