Re: [PATCH] libsepol/cil: Output culprit rules from binary policy when CIL AST match fails

On Tue, Aug 11, 2026 at 11:48 AM James Carter <[email protected]> wrote:
>
> On Tue, Aug 11, 2026 at 12:29 AM Thiébaud Weksteen <[email protected]> wrote:
> >
> > Commit d8507429f15c ("secilc: Add program that checks CIL neverallows
> > against a binary policy") added secilcheck to validate neverallows against
> > a binary policy.
> >
> > When a violation occurs, secilcheck attempts to locate matching allow
> > rules in the CIL AST. However, since the CIL AST in secilcheck only
> > contains neverallow rules and declarations (not allow rules),
> > cil_find_matching_avrule_in_ast() returns an empty set, resulting in no
> > culprit allow rules being printed.
> >
> > Fall back to calling report_assertion_failures() to output the culprit
> > allow rules from the binary policydb when no matching rules are found in
> > the CIL AST.
> >
> > Signed-off-by: Thiébaud Weksteen <[email protected]>
>
> Acked-by: James Carter <[email protected]>

Thanks, merged.