[PATCH] libsepol: Validate the genfs file type class

[PATCH] libsepol: Validate the genfs file type class

[James Carter]

Like file contexts, genfscon rules can have an optional file type.
These file types are mapped to the value of the corresponding
security class. If no file type is given, then the value is set to
0. During validation the value is verified to be either 0 or a valid
value for a class, but not all security classes correspond to a file
type.

When validating a policy, verify that the value is either 0 or the
name of the class with that value corresponds to a file type.

Signed-off-by: James Carter <jwcart2@gmail.com>
---
 libsepol/src/policydb_validate.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
index 5fd64b12..34182e8e 100644
--- a/libsepol/src/policydb_validate.c
+++ b/libsepol/src/policydb_validate.c
@@ -1628,6 +1628,19 @@ bad:
 	return -1;
 }
 
+static int validate_genfs_class(uint32_t sclass, const policydb_t *p)
+{
+	const char *class_name = p->p_class_val_to_name[sclass - 1];
+
+	if (strcmp(class_name, "file") && strcmp(class_name, "dir") &&
+	    strcmp(class_name, "chr_file") && strcmp(class_name, "blk_file") &&
+	    strcmp(class_name, "sock_file") &&
+	    strcmp(class_name, "fifo_file") && strcmp(class_name, "lnk_file"))
+		return -1;
+
+	return 0;
+}
+
 static int validate_genfs(sepol_handle_t *handle, const policydb_t *p,
 			  validate_t flavors[])
 {
@@ -1639,10 +1652,13 @@ static int validate_genfs(sepol_handle_t *handle, const policydb_t *p,
 			if (validate_context(&octx->context[0], flavors,
 					     p->mls))
 				goto bad;
-			if (octx->v.sclass &&
-			    validate_value(octx->v.sclass,
-					   &flavors[SYM_CLASSES]))
-				goto bad;
+			if (octx->v.sclass) {
+				if (validate_value(octx->v.sclass,
+						   &flavors[SYM_CLASSES]))
+					goto bad;
+				if (validate_genfs_class(octx->v.sclass, p))
+					goto bad;
+			}
 		}
 
 		if (validate_string_field(genfs->fstype))
-- 
2.55.0

Re: [PATCH] libsepol: Validate the genfs file type class

[Stephen Smalley]

On Tue, Sep 1, 2026 at 1:21 PM James Carter <jwcart2@gmail.com> wrote:
>
> Like file contexts, genfscon rules can have an optional file type.
> These file types are mapped to the value of the corresponding
> security class. If no file type is given, then the value is set to
> 0. During validation the value is verified to be either 0 or a valid
> value for a class, but not all security classes correspond to a file
> type.
>
> When validating a policy, verify that the value is either 0 or the
> name of the class with that value corresponds to a file type.
>
> Signed-off-by: James Carter <jwcart2@gmail.com>

Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Re: [PATCH] libsepol: Validate the genfs file type class

[Stephen Smalley]

On Tue, Sep 1, 2026 at 2:08 PM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
>
> On Tue, Sep 1, 2026 at 1:21 PM James Carter <jwcart2@gmail.com> wrote:
> >
> > Like file contexts, genfscon rules can have an optional file type.
> > These file types are mapped to the value of the corresponding
> > security class. If no file type is given, then the value is set to
> > 0. During validation the value is verified to be either 0 or a valid
> > value for a class, but not all security classes correspond to a file
> > type.
> >
> > When validating a policy, verify that the value is either 0 or the
> > name of the class with that value corresponds to a file type.
> >
> > Signed-off-by: James Carter <jwcart2@gmail.com>
>
> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Merged.