Re: [PATCH 1/2] libsepol: Copy a chain of type alias references

On Tue, Aug 11, 2026 at 11:17 AM James Carter <[email protected]> wrote:
>
> For a policy with multiple modules it is possible for there to be
> a chain of type alias references where an alias in one module refers
> to an alias in another module which refers an alias in a third
> module and so on. When expanding a policy with this sort of chain,
> a situation can arise where an alias being copied references an
> alias that has yet to be copied. Since the value of an alias is set
> to the typemap of its primary and the typemap of its primary has not
> been set yet, this alias will end up with an invalid value of 0 and
> return an error.
>
> When copying aliases, skip over aliases that refer to an alias that
> has yet to be copied and keep repeating the copying of aliases until
> none have been skipped or the maximum number of repeats has been
> exceeded.
>
> Signed-off-by: James Carter <[email protected]>
> ---
>  libsepol/src/expand.c | 47 ++++++++++++++++++++++++++++---------------
>  1 file changed, 31 insertions(+), 16 deletions(-)
>
> diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
> index 466d5bc1..96d7b332 100644
> --- a/libsepol/src/expand.c
> +++ b/libsepol/src/expand.c
> @@ -39,6 +39,8 @@
>  #include "debug.h"
>  #include "private.h"
>
> +#define MAX_ALIAS_REPEATS 32
> +

Ideally this would be lifted to a header file like private.h shared by
both files.

Otherwise,
Acked-by: Stephen Smalley <[email protected]>