Re: [PATCH] libsepol: Check all the permissions in sepol_check_access()

On Tue, Aug 18, 2026 at 3:22 PM James Carter <[email protected]> wrote:
>
> The function sepol_check_access() takes five arguments: a path to

technically it's the program sepol_check_access, not the function

> a policy, a source context string, a target context string, a
> security class string, and a comma-separated list of permissions.
> It calls functions to turn all the strings into structs that can

technically it is into values (SIDs, classes, or access vectors)
rather than struts

> be passed to sepol_compute_av_reason_buffer(). Unfortunately, as
> each permission in the permission list is converted to an access
> vector, the previous access vector value is overwritten, so only
> the last permisison is used in the access check.

Typo: permission

>
> Use a temporary access vector when converting each permission
> string to an access vector and "or" it to the final access
> vector before processing the next permission string.
>
> Signed-off-by: James Carter <[email protected]>

Otherwise,
Acked-by: Stephen Smalley <[email protected]>

> ---
>  libsepol/utils/sepol_check_access.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/libsepol/utils/sepol_check_access.c b/libsepol/utils/sepol_check_access.c
> index fb3b7edd..e80d6464 100644
> --- a/libsepol/utils/sepol_check_access.c
> +++ b/libsepol/utils/sepol_check_access.c
> @@ -12,7 +12,7 @@ int main(int argc, char *argv[])
>         sepol_security_id_t ssid, tsid;
>         sepol_security_class_t tclass;
>         const char *permlist;
> -       sepol_access_vector_t av;
> +       sepol_access_vector_t av = 0;
>         struct sepol_av_decision avd;
>         unsigned int reason;
>         char *reason_buf;
> @@ -58,6 +58,7 @@ int main(int argc, char *argv[])
>                 char *tmp = NULL;
>                 const char *perm;
>                 const char *delim = strchr(permlist, ',');
> +               sepol_access_vector_t perm_av;
>
>                 if (delim) {
>                         tmp = strndup(permlist, delim - permlist);
> @@ -71,7 +72,7 @@ int main(int argc, char *argv[])
>
>                 perm = tmp ? tmp : permlist;
>
> -               if (sepol_string_to_av_perm(tclass, perm, &av) < 0) {
> +               if (sepol_string_to_av_perm(tclass, perm, &perm_av) < 0) {
>                         fprintf(stderr,
>                                 "Invalid permission %s for security class %s:  %s\n",
>                                 perm, argv[4], strerror(errno));
> @@ -79,6 +80,8 @@ int main(int argc, char *argv[])
>                         return 1;
>                 }
>
> +               av |= perm_av;
> +
>                 free(tmp);
>
>                 permlist = strchr(permlist, ',');
> --
> 2.55.0
>