Re: [PATCH v2] libsepol: reject policies with no avtab entries in expand_module()

On Tue, Aug 4, 2026 at 12:53 PM Stephen Smalley
<[email protected]> wrote:
>
> avtab_read() already rejects policies that have no avtab entries in
> both libsepol and the kernel, but expand_module() can produce a
> policydb that has none. Check and reject such policies in
> expand_module() so that checkpolicy (and its fuzzer) will fail rather
> than writing out an invalid binary policy.
>
> Update the libsepol test-expander policies to include at least one av
> rule so that they produce at least one avtab entry.
>
> Reported-by: oss-fuzz (issue 541553475)
> Signed-off-by: Stephen Smalley <[email protected]>

Merged.