[PATCH 1/2] libsepol: Validate expressions do not mix tunables and booleans

[PATCH 1/2] libsepol: Validate expressions do not mix tunables and booleans

[James Carter]

A conditional expression should never have a mixture of both
tunables and booleans. This is not allowed in CIL, checkpolicy,
or checkmodule and could only occur in a maliciously crafted
binary policy.

When validating the policy, validate that conditional expressions
do not contain a mixture of both tunables and booleans and exit
with an error if they do.

Signed-off-by: James Carter <jwcart2@gmail.com>
---
 libsepol/src/policydb_validate.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
index fe8bf1cf..7d9ae3fd 100644
--- a/libsepol/src/policydb_validate.c
+++ b/libsepol/src/policydb_validate.c
@@ -1322,9 +1322,12 @@ bad:
 }
 
 static int validate_cond_expr(sepol_handle_t *handle,
-			      const struct cond_expr *expr,
+			      const struct cond_expr *expr, const policydb_t *p,
 			      const validate_t *boolean)
 {
+	cond_bool_datum_t *booldatum;
+	int booleans = 0;
+	int tunables = 0;
 	int depth = -1;
 
 	if (!expr)
@@ -1338,6 +1341,11 @@ static int validate_cond_expr(sepol_handle_t *handle,
 			if (depth >= (COND_EXPR_MAXDEPTH - 1))
 				goto bad;
 			depth++;
+			booldatum = p->bool_val_to_struct[expr->boolean - 1];
+			if (booldatum->flags & COND_BOOL_FLAGS_TUNABLE)
+				tunables++;
+			else
+				booleans++;
 			break;
 		case COND_NOT:
 			if (depth < 0)
@@ -1364,6 +1372,12 @@ static int validate_cond_expr(sepol_handle_t *handle,
 	if (depth != 0)
 		goto bad;
 
+	if (tunables && booleans) {
+		ERR(handle, "Found both tunables and booleans in the same "
+			    "conditional expression");
+		goto bad;
+	}
+
 	return 0;
 
 bad:
@@ -1375,7 +1389,8 @@ static int validate_cond_list(sepol_handle_t *handle, const cond_list_t *cond,
 			      const policydb_t *p, validate_t flavors[])
 {
 	for (; cond; cond = cond->next) {
-		if (validate_cond_expr(handle, cond->expr, &flavors[SYM_BOOLS]))
+		if (validate_cond_expr(handle, cond->expr, p,
+				       &flavors[SYM_BOOLS]))
 			goto bad;
 		if (validate_cond_av_list(handle, cond->true_list, p, flavors))
 			goto bad;
-- 
2.55.0

[PATCH 2/2] libsepol: Remove assertion and comment from discard_tunables()

[James Carter]

Policy validation ensures that there is never a mixture of tunables
and booleans in one expression, this means that the assertion in
discard_tunables() is not needed.

Remove the assertion and the comment (which is incorrect) above
the assertion. Since the variable "tunables" was only used in the
assertion, remove it as well.

Signed-off-by: James Carter <jwcart2@gmail.com>
---
 libsepol/src/expand.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
index 18718973..f7ff61cd 100644
--- a/libsepol/src/expand.c
+++ b/libsepol/src/expand.c
@@ -3194,7 +3194,7 @@ static void discard_tunables(sepol_handle_t *sh, policydb_t *pol)
 
 		for (cur_node = decl->cond_list; cur_node != NULL;
 		     cur_node = cur_node->next) {
-			int booleans = 0, tunables = 0;
+			int booleans = 0;
 			cond_bool_datum_t *booldatum;
 
 			for (cur_expr = cur_node->expr; cur_expr != NULL;
@@ -3205,7 +3205,6 @@ static void discard_tunables(sepol_handle_t *sh, policydb_t *pol)
 						    [cur_expr->boolean - 1];
 				if (booldatum->flags &
 				    COND_BOOL_FLAGS_TUNABLE) {
-					tunables++;
 					if (preserve_tunables)
 						booldatum->flags &=
 							~COND_BOOL_FLAGS_TUNABLE;
@@ -3214,13 +3213,6 @@ static void discard_tunables(sepol_handle_t *sh, policydb_t *pol)
 				}
 			}
 
-			/* bool_copy_callback() at link phase has ensured
-			 * that no mixture of tunables and booleans in one
-			 * expression. However, this would be broken by the
-			 * request to preserve tunables */
-			if (!preserve_tunables)
-				assert(!(booleans && tunables));
-
 			if (booleans || preserve_tunables) {
 				cur_node->flags &= ~COND_NODE_FLAGS_TUNABLE;
 			} else {
-- 
2.55.0

Re: [PATCH 1/2] libsepol: Validate expressions do not mix tunables and booleans

[Stephen Smalley]

On Thu, Aug 20, 2026 at 11:41 AM James Carter <jwcart2@gmail.com> wrote:
>
> A conditional expression should never have a mixture of both
> tunables and booleans. This is not allowed in CIL, checkpolicy,
> or checkmodule and could only occur in a maliciously crafted
> binary policy.
>
> When validating the policy, validate that conditional expressions
> do not contain a mixture of both tunables and booleans and exit
> with an error if they do.
>
> Signed-off-by: James Carter <jwcart2@gmail.com>

Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Re: [PATCH 2/2] libsepol: Remove assertion and comment from discard_tunables()

[Stephen Smalley]

On Thu, Aug 20, 2026 at 11:41 AM James Carter <jwcart2@gmail.com> wrote:
>
> Policy validation ensures that there is never a mixture of tunables
> and booleans in one expression, this means that the assertion in
> discard_tunables() is not needed.
>
> Remove the assertion and the comment (which is incorrect) above
> the assertion. Since the variable "tunables" was only used in the
> assertion, remove it as well.
>
> Signed-off-by: James Carter <jwcart2@gmail.com>

Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Re: [PATCH 1/2] libsepol: Validate expressions do not mix tunables and booleans

[Stephen Smalley]

On Thu, Aug 20, 2026 at 1:04 PM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
>
> On Thu, Aug 20, 2026 at 11:41 AM James Carter <jwcart2@gmail.com> wrote:
> >
> > A conditional expression should never have a mixture of both
> > tunables and booleans. This is not allowed in CIL, checkpolicy,
> > or checkmodule and could only occur in a maliciously crafted
> > binary policy.
> >
> > When validating the policy, validate that conditional expressions
> > do not contain a mixture of both tunables and booleans and exit
> > with an error if they do.
> >
> > Signed-off-by: James Carter <jwcart2@gmail.com>
>
> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Thanks, both merged.