[PATCH v2] checkpolicy: Check for mls constraint expression in non-mls policy

[James Carter <jwcart2@gmail.com>]

In a constraint expression l1, l2, h1, and h2 all refer to levels
and should only appear in mls policies.

Return an error if a mls constraint expression is found in a non-
mls policy.

Signed-off-by: James Carter <jwcart2@gmail.com>
---
v2: Fix typo in commit message.

 checkpolicy/policy_define.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
index 30157826..1984c52f 100644
--- a/checkpolicy/policy_define.c
+++ b/checkpolicy/policy_define.c
@@ -4055,6 +4055,12 @@ uintptr_t define_cexpr(uint32_t expr_type, uintptr_t arg1, uintptr_t arg2)
 		e1->next = expr;
 		return arg1;
 	case CEXPR_ATTR:
+		if (!mlspol && (arg1 >= CEXPR_L1L2)) {
+			yyerror("MLS constraint expression "
+				"in non-MLS configuration");
+			constraint_expr_destroy(expr);
+			return 0;
+		}
 		expr->attr = arg1;
 		expr->op = arg2;
 		return (uintptr_t)expr;
-- 
2.55.0