diff mbox series

[4/5] libsepol: reject MLS support in pre-MLS policies

Message ID 20240311145706.34885-4-cgzones@googlemail.com (mailing list archive)
State Accepted
Commit 6f7ddf2742f1
Delegated to: Petr Lautrbach
Headers show
Series [1/5] checkpolicy/fuzz: drop redundant notdefined check | expand

Commit Message

Christian Göttsche March 11, 2024, 2:57 p.m. UTC 
If MLS support is enabled check the policy version supports MLS.

Reported-by: oss-fuzz (issue #67322)
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 libsepol/src/policydb_validate.c | 4 ++++
 1 file changed, 4 insertions(+)
diff mbox series

Patch

diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
index 6e46f426..e987d8da 100644
--- a/libsepol/src/policydb_validate.c
+++ b/libsepol/src/policydb_validate.c
@@ -1554,11 +1554,15 @@  static int validate_properties(sepol_handle_t *handle, const policydb_t *p)
 	case POLICY_KERN:
 		if (p->policyvers < POLICYDB_VERSION_MIN || p->policyvers > POLICYDB_VERSION_MAX)
 			goto bad;
+		if (p->mls && p->policyvers < POLICYDB_VERSION_MLS)
+			goto bad;
 		break;
 	case POLICY_BASE:
 	case POLICY_MOD:
 		if (p->policyvers < MOD_POLICYDB_VERSION_MIN || p->policyvers > MOD_POLICYDB_VERSION_MAX)
 			goto bad;
+		if (p->mls && p->policyvers < MOD_POLICYDB_VERSION_MLS)
+			goto bad;
 		break;
 	default:
 		goto bad;