[PATCH] libsepol: Check that a module does not have any commons when validating

[PATCH] libsepol: Check that a module does not have any commons when validating

[James Carter]

Since a common cannot be declared in a module and cannot be
required, there should not be any commons in a policy module. But
a maliciously crafted policy could add one which could cause
problems when processing the module.

Check that a module does not contain any commons when validating
the module after reading it in and quit with an error if it does.

Signed-off-by: James Carter <jwcart2@gmail.com>
---
 libsepol/src/policydb_validate.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
index 0469b0c1..fe8bf1cf 100644
--- a/libsepol/src/policydb_validate.c
+++ b/libsepol/src/policydb_validate.c
@@ -2092,6 +2092,8 @@ int policydb_validate(sepol_handle_t *handle, const policydb_t *p)
 			if (validate_filename_trans_hashtab(handle, p, flavors))
 				goto bad;
 	} else {
+		if ((p->policy_type == POLICY_MOD) && (p->p_commons.nprim > 0))
+			goto bad;
 		if (validate_avrule_blocks(handle, p->global, p, flavors))
 			goto bad;
 	}
-- 
2.55.0

Re: [PATCH] libsepol: Check that a module does not have any commons when validating

[Stephen Smalley]

On Wed, Aug 12, 2026 at 4:03 PM James Carter <jwcart2@gmail.com> wrote:
>
> Since a common cannot be declared in a module and cannot be
> required, there should not be any commons in a policy module. But
> a maliciously crafted policy could add one which could cause
> problems when processing the module.
>
> Check that a module does not contain any commons when validating
> the module after reading it in and quit with an error if it does.
>
> Signed-off-by: James Carter <jwcart2@gmail.com>

Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>

and merged.