Re: [PATCH 2/2] libsepol: Improve the validation of type aliases

On Tue, Aug 11, 2026 at 11:17 AM James Carter <[email protected]> wrote:
>
> A maliciously crafted binary policy could have a type alias that
> refers to an attribute or that ultimately refers back to itself
> in a loop.
>
> Validate that type aliases ultimately refer to a primary type
> and not to an attribute or themselves.
>
> Signed-off-by: James Carter <[email protected]>
> ---
>  libsepol/src/policydb_validate.c | 72 +++++++++++++++++++++-----------
>  1 file changed, 47 insertions(+), 25 deletions(-)
>
> diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
> index 5687c82b..5178a2b4 100644
> --- a/libsepol/src/policydb_validate.c
> +++ b/libsepol/src/policydb_validate.c
> @@ -13,6 +13,8 @@
>  #define bool_xor(a, b) (!(a) != !(b))
>  #define bool_xnor(a, b) (!bool_xor(a, b))
>
> +#define MAX_ALIAS_REPEATS 32
> +

Ideally this would be lifted to a header file like private.h shared by
both files.

Otherwise,
Acked-by: Stephen Smalley <[email protected]>