Re: [PATCH] libsepol: Do not convert mls rules to CIL for a non-mls policy

On Tue, Aug 4, 2026 at 2:48 PM James Carter <[email protected]> wrote:
>
> When converting a module policydb to CIL mls rules for sensitivies
> and categories are processed if they exist even for a non-mls
> policy. This allows for a maliciously crafted policy to cause an
> OOB access.
>
> If the policy is not an mls policy, then skip sensitivity,
> category, and the ordering rules for sensitivies and categories.
>
> Signed-off-by: James Carter <[email protected]>

Acked-by: Stephen Smalley <[email protected]>

> ---
>  libsepol/src/module_to_cil.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
>
> diff --git a/libsepol/src/module_to_cil.c b/libsepol/src/module_to_cil.c
> index 06fbdc30..6876bd76 100644
> --- a/libsepol/src/module_to_cil.c
> +++ b/libsepol/src/module_to_cil.c
> @@ -2711,6 +2711,9 @@ static int sens_to_cil(int indent, struct policydb *pdb,
>  {
>         level_datum_t *level = datum;
>
> +       if (!pdb->mls)
> +               return 0;
> +
>         if (scope == SCOPE_DECL) {
>                 if (!level->isalias) {
>                         cil_println(indent, "(sensitivity %s)", key);
> @@ -2738,6 +2741,9 @@ static int sens_order_to_cil(int indent, struct policydb *pdb,
>         struct ebitmap_node *node;
>         uint32_t i;
>
> +       if (!pdb->mls)
> +               return 0;
> +
>         if (ebitmap_is_empty(&order)) {
>                 return 0;
>         }
> @@ -2761,6 +2767,9 @@ static int cat_to_cil(int indent, struct policydb *pdb,
>  {
>         struct cat_datum *cat = datum;
>
> +       if (!pdb->mls)
> +               return 0;
> +
>         if (scope == SCOPE_REQ) {
>                 return 0;
>         }
> @@ -2783,6 +2792,9 @@ static int cat_order_to_cil(int indent, struct policydb *pdb,
>         struct ebitmap_node *node;
>         uint32_t i;
>
> +       if (!pdb->mls)
> +               return 0;
> +
>         if (ebitmap_is_empty(&order)) {
>                 rc = 0;
>                 goto exit;
> --
> 2.55.0
>