[PATCH] libsepol/cil: Expand class-permissions in deny rules

[James Carter <jwcart2@gmail.com>]

The classperms list of deny rules is not being expanded. This causes
an invalid read if "all" is used in the permissions.

Evaluate the classperms list of deny rules.

Reported-by: oss-fuzz (issue 398075935)
Signed-off-by: James Carter <jwcart2@gmail.com>
---
 libsepol/cil/src/cil_post.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/libsepol/cil/src/cil_post.c b/libsepol/cil/src/cil_post.c
index 70e5b734..2b6dad73 100644
--- a/libsepol/cil/src/cil_post.c
+++ b/libsepol/cil/src/cil_post.c
@@ -2265,6 +2265,14 @@ static int __cil_post_db_classperms_helper(struct cil_tree_node *node, uint32_t
 		}
 		break;
 	}
+	case CIL_DENY_RULE: {
+		struct cil_deny_rule *deny = node->data;
+		rc = __evaluate_classperms_list(deny->classperms, db);
+		if (rc != SEPOL_OK) {
+			goto exit;
+		}
+		break;
+	}
 	case CIL_CONSTRAIN:
 	case CIL_MLSCONSTRAIN: {
 		struct cil_constrain *constrain = node->data;
-- 
2.50.0