Re: [PATCH v3] libsepol: Validate any levels that appear in a policy

On Wed, Aug 5, 2026 at 11:30 AM James Carter <[email protected]> wrote:
>
> Policy validation only validates levels for MLS policies, but it
> is easy to create a non-mls policy with levels (just read the
> policy in, change the "mls" field of the policydb to 0, and write
> the policy out). A maliciously crafted non-mls policy could have
> levels that cause an OOB access when processed.
>
> Because of this, validate any levels that appear in any policy,
> even if it is a non-mls policy.
>
> Signed-off-by: James Carter <[email protected]>
> Acked-by: Stephen Smalley <[email protected]>

Merged.