Re: [PATCH] libsepol: Do not convert mls rules to CIL for a non-mls policy

On Tue, Aug 4, 2026 at 3:24 PM Stephen Smalley
<[email protected]> wrote:
>
> On Tue, Aug 4, 2026 at 2:48 PM James Carter <[email protected]> wrote:
> >
> > When converting a module policydb to CIL mls rules for sensitivies
> > and categories are processed if they exist even for a non-mls
> > policy. This allows for a maliciously crafted policy to cause an
> > OOB access.
> >
> > If the policy is not an mls policy, then skip sensitivity,
> > category, and the ordering rules for sensitivies and categories.
> >
> > Signed-off-by: James Carter <[email protected]>
>
> Acked-by: Stephen Smalley <[email protected]>

Merged.