Re: [PATCH v2] libsepol: Check all the permissions in sepol_check_access()

On Wed, Aug 19, 2026 at 11:09 AM Stephen Smalley
<[email protected]> wrote:
>
> On Wed, Aug 19, 2026 at 10:57 AM James Carter <[email protected]> wrote:
> >
> > The program sepol_check_access() takes five arguments: a path to
>
> Can fix on merge but both on the line above and the subject line it still has ()
> as if it was a function whereas it is a program/utility.
>

Merged with fixed (again) commit message.
Thanks,
Jim

> > a policy, a source context string, a target context string, a
> > security class string, and a comma-separated list of permissions.
> > It calls functions to turn all the strings into values that can
> > be passed to sepol_compute_av_reason_buffer(). Unfortunately, as
> > each permission in the permission list is converted to an access
> > vector, the previous access vector value is overwritten, so only
> > the last permission is used in the access check.
> >
> > Use a temporary access vector when converting each permission
> > string to an access vector and "or" it to the final access
> > vector before processing the next permission string.
> >
> > Signed-off-by: James Carter <[email protected]>
> > Acked-by: Stephen Smalley <[email protected]>
> > ---
> > v2: Fix commit message based on Stephen's suggestions
> >
> >  libsepol/utils/sepol_check_access.c | 7 +++++--
> >  1 file changed, 5 insertions(+), 2 deletions(-)
> >
> > diff --git a/libsepol/utils/sepol_check_access.c b/libsepol/utils/sepol_check_access.c
> > index fb3b7edd..e80d6464 100644
> > --- a/libsepol/utils/sepol_check_access.c
> > +++ b/libsepol/utils/sepol_check_access.c
> > @@ -12,7 +12,7 @@ int main(int argc, char *argv[])
> >         sepol_security_id_t ssid, tsid;
> >         sepol_security_class_t tclass;
> >         const char *permlist;
> > -       sepol_access_vector_t av;
> > +       sepol_access_vector_t av = 0;
> >         struct sepol_av_decision avd;
> >         unsigned int reason;
> >         char *reason_buf;
> > @@ -58,6 +58,7 @@ int main(int argc, char *argv[])
> >                 char *tmp = NULL;
> >                 const char *perm;
> >                 const char *delim = strchr(permlist, ',');
> > +               sepol_access_vector_t perm_av;
> >
> >                 if (delim) {
> >                         tmp = strndup(permlist, delim - permlist);
> > @@ -71,7 +72,7 @@ int main(int argc, char *argv[])
> >
> >                 perm = tmp ? tmp : permlist;
> >
> > -               if (sepol_string_to_av_perm(tclass, perm, &av) < 0) {
> > +               if (sepol_string_to_av_perm(tclass, perm, &perm_av) < 0) {
> >                         fprintf(stderr,
> >                                 "Invalid permission %s for security class %s:  %s\n",
> >                                 perm, argv[4], strerror(errno));
> > @@ -79,6 +80,8 @@ int main(int argc, char *argv[])
> >                         return 1;
> >                 }
> >
> > +               av |= perm_av;
> > +
> >                 free(tmp);
> >
> >                 permlist = strchr(permlist, ',');
> > --
> > 2.55.0
> >