Re: [PATCH] libselinux: selinux_check_access: fail cleanly if avc_open() failed

On Thu, Aug 13, 2026 at 2:40 PM Stephen Smalley
<[email protected]> wrote:
>
> avc_init_once() calls avc_open() but discards a failure result, and a
> subsequent selinux_check_access() proceeds to avc_context_to_sid()
> which now hits assert(avc_running) and aborts the caller.
>
> Latch the initializer outcome and have selinux_check_access() return
> -1/EINVAL when the AVC never came up, so callers see an error rather
> than a SIGABRT.
>
> Signed-off-by: Stephen Smalley <[email protected]>

Acked-by: James Carter <[email protected]>

> ---
>  libselinux/src/checkAccess.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/libselinux/src/checkAccess.c b/libselinux/src/checkAccess.c
> index d8f485e9..3cdd2413 100644
> --- a/libselinux/src/checkAccess.c
> +++ b/libselinux/src/checkAccess.c
> @@ -9,14 +9,13 @@
>
>  static pthread_once_t once = PTHREAD_ONCE_INIT;
>  static int selinux_enabled;
> +static int avc_ok;
>
>  static void avc_init_once(void)
>  {
>         selinux_enabled = is_selinux_enabled();
> -       if (selinux_enabled == 1) {
> -               if (avc_open(NULL, 0))
> -                       return;
> -       }
> +       if (selinux_enabled == 1 && avc_open(NULL, 0) == 0)
> +               avc_ok = 1;
>  }
>
>  int selinux_check_access(const char *scon, const char *tcon, const char *class,
> @@ -33,6 +32,11 @@ int selinux_check_access(const char *scon, const char *tcon, const char *class,
>         if (selinux_enabled != 1)
>                 return 0;
>
> +       if (!avc_ok) {
> +               errno = EINVAL;
> +               return -1;
> +       }
> +
>         rc = avc_context_to_sid(scon, &scon_id);
>         if (rc < 0)
>                 return rc;
> --
> 2.55.0
>