Re: [PATCH 1/2] libsepol: Validate expressions do not mix tunables and booleans

On Thu, Aug 20, 2026 at 11:41 AM James Carter <[email protected]> wrote:
>
> A conditional expression should never have a mixture of both
> tunables and booleans. This is not allowed in CIL, checkpolicy,
> or checkmodule and could only occur in a maliciously crafted
> binary policy.
>
> When validating the policy, validate that conditional expressions
> do not contain a mixture of both tunables and booleans and exit
> with an error if they do.
>
> Signed-off-by: James Carter <[email protected]>

Acked-by: Stephen Smalley <[email protected]>