[PATCH] libsepol: Non-mls polcies should not have any levels

[PATCH] libsepol: Non-mls polcies should not have any levels

[James Carter]

A maliciously crafted non-mls policy could still have levels in it.
There is no validation of levels for a non-mls policy which could
cause a problem if those levels are processed somewhere in libsepol.

A non-mls policy should have no entries in the level symbol table,
so check that the symbol table is empty when validating and return
an error if it is not.

Signed-off-by: James Carter <jwcart2@gmail.com>
---
 libsepol/src/policydb_validate.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
index fc66a4c7..fa36950e 100644
--- a/libsepol/src/policydb_validate.c
+++ b/libsepol/src/policydb_validate.c
@@ -1024,9 +1024,14 @@ static int validate_datum_array_entries(sepol_handle_t *handle,
 			&margs))
 		goto bad;
 
-	if (p->mls && hashtab_map(symtabs[SYM_LEVELS].table,
+	if (p->mls) {
+		if (hashtab_map(symtabs[SYM_LEVELS].table,
 				  validate_level_datum_wrapper, &margs))
-		goto bad;
+			goto bad;
+	} else {
+		if (symtabs[SYM_LEVELS].table->nel != 0)
+			goto bad;
+	}
 
 	if (hashtab_map(symtabs[SYM_CATS].table, validate_datum,
 			&flavors[SYM_CATS]))
-- 
2.55.0

Re: [PATCH] libsepol: Non-mls polcies should not have any levels

[Stephen Smalley]

On Tue, Aug 4, 2026 at 2:25 PM James Carter <jwcart2@gmail.com> wrote:
>
> A maliciously crafted non-mls policy could still have levels in it.
> There is no validation of levels for a non-mls policy which could
> cause a problem if those levels are processed somewhere in libsepol.
>
> A non-mls policy should have no entries in the level symbol table,
> so check that the symbol table is empty when validating and return
> an error if it is not.
>
> Signed-off-by: James Carter <jwcart2@gmail.com>

Triggers a test failure in libsepol:
Suite: downgrade
  Test: downgrade ...error reading policy binary, version 34
(downgraded from 35)

Error during downgrade testing of Non-MLS policy
FAILED
    1. test-downgrade.c:183  - CU_FAIL("Unable to read downgraded
binary policy")

Also typo in the subject line (polcies).