Re: [PATCH 1/2] libsepol: Validate expressions do not mix tunables and booleans

On Thu, Aug 20, 2026 at 1:04 PM Stephen Smalley
<[email protected]> wrote:
>
> On Thu, Aug 20, 2026 at 11:41 AM James Carter <[email protected]> wrote:
> >
> > A conditional expression should never have a mixture of both
> > tunables and booleans. This is not allowed in CIL, checkpolicy,
> > or checkmodule and could only occur in a maliciously crafted
> > binary policy.
> >
> > When validating the policy, validate that conditional expressions
> > do not contain a mixture of both tunables and booleans and exit
> > with an error if they do.
> >
> > Signed-off-by: James Carter <[email protected]>
>
> Acked-by: Stephen Smalley <[email protected]>

Thanks, both merged.