[PATCH v2] checkpolicy: Check for mls constraint expression in non-mls policy

[PATCH v2] checkpolicy: Check for mls constraint expression in non-mls policy

[James Carter]

In a constraint expression l1, l2, h1, and h2 all refer to levels
and should only appear in mls policies.

Return an error if a mls constraint expression is found in a non-
mls policy.

Signed-off-by: James Carter <jwcart2@gmail.com>
---
v2: Fix typo in commit message.

 checkpolicy/policy_define.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
index 30157826..1984c52f 100644
--- a/checkpolicy/policy_define.c
+++ b/checkpolicy/policy_define.c
@@ -4055,6 +4055,12 @@ uintptr_t define_cexpr(uint32_t expr_type, uintptr_t arg1, uintptr_t arg2)
 		e1->next = expr;
 		return arg1;
 	case CEXPR_ATTR:
+		if (!mlspol && (arg1 >= CEXPR_L1L2)) {
+			yyerror("MLS constraint expression "
+				"in non-MLS configuration");
+			constraint_expr_destroy(expr);
+			return 0;
+		}
 		expr->attr = arg1;
 		expr->op = arg2;
 		return (uintptr_t)expr;
-- 
2.55.0

Re: [PATCH v2] checkpolicy: Check for mls constraint expression in non-mls policy

[Stephen Smalley]

On Mon, Aug 31, 2026 at 11:44 AM James Carter <jwcart2@gmail.com> wrote:
>
> In a constraint expression l1, l2, h1, and h2 all refer to levels
> and should only appear in mls policies.
>
> Return an error if a mls constraint expression is found in a non-
> mls policy.
>
> Signed-off-by: James Carter <jwcart2@gmail.com>

Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Re: [PATCH v2] checkpolicy: Check for mls constraint expression in non-mls policy

[Stephen Smalley]

On Mon, Aug 31, 2026 at 1:02 PM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
>
> On Mon, Aug 31, 2026 at 11:44 AM James Carter <jwcart2@gmail.com> wrote:
> >
> > In a constraint expression l1, l2, h1, and h2 all refer to levels
> > and should only appear in mls policies.
> >
> > Return an error if a mls constraint expression is found in a non-
> > mls policy.
> >
> > Signed-off-by: James Carter <jwcart2@gmail.com>
>
> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Thanks, merged.