Re: [PATCH] libselinux: apply requested level to failsafe contexts

[Filippo Bonazzi <fbonazzi@suse.de>]

[-- Attachment #1: Type: text/plain, Size: 1958 bytes --]

On 2026-11-06 13:10 (UTC -0500), Stephen Smalley wrote:
>The level-aware context lookup APIs replace the range in the starting
>context, which get_context_user() then copies into matching
>candidates. When no candidate survives, get_failsafe_context() instead
>returns the configured failsafe range unchanged. A NULL starting
>context also hits this path when the current role and type have no
>matching entry.
>
>Carry the explicitly requested level through an internal list lookup
>and apply it to the failsafe context before
>security_check_context(). Keep the configured range for ordinary
>lookups and preserve the existing ENOENT validation exception. Route
>role-and-level lookup through the same level-aware list implementation
>so it receives the fix too.
>
>Add 309 regression cases covering all three APIs, explicit and current
>starting contexts, per-user/global/missing configuration, rejected
>candidates, validation of the final range, and failure/retry at the
>new allocation steps. The test uses private configuration files and
>wraps getcon and kernel validation; no host policy is changed.
>
>Reported-by: Filippo Bonazzi <fbonazzi@suse.de>
>Fixes: https://github.com/SELinuxProject/selinux/issues/508
>Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
>---
> libselinux/src/get_context_list.c     |  84 +++++-----
> libselinux/tests/.gitignore           |   1 +
> libselinux/tests/Makefile             |   7 +
> libselinux/tests/test_context_level.c | 221 ++++++++++++++++++++++++++
> 4 files changed, 273 insertions(+), 40 deletions(-)

Hi, I can confirm that this fixes the issue we originally reported on openSUSE
Tumbleweed. Thank you very much for the fix, and please keep me in the loop when
this will be published in a proper release.

Thanks,

Filippo

-- 
Filippo Bonazzi
Security Engineer                        suse.com
8257 4398 947A 2DBE F21D 76E6 937A 63F0 5B36 46D9

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 525 bytes --]