[PATCH] libsepol: Do not convert mls rules to CIL for a non-mls policy

[James Carter <jwcart2@gmail.com>]

When converting a module policydb to CIL mls rules for sensitivies
and categories are processed if they exist even for a non-mls
policy. This allows for a maliciously crafted policy to cause an
OOB access.

If the policy is not an mls policy, then skip sensitivity,
category, and the ordering rules for sensitivies and categories.

Signed-off-by: James Carter <jwcart2@gmail.com>
---
 libsepol/src/module_to_cil.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/libsepol/src/module_to_cil.c b/libsepol/src/module_to_cil.c
index 06fbdc30..6876bd76 100644
--- a/libsepol/src/module_to_cil.c
+++ b/libsepol/src/module_to_cil.c
@@ -2711,6 +2711,9 @@ static int sens_to_cil(int indent, struct policydb *pdb,
 {
 	level_datum_t *level = datum;
 
+	if (!pdb->mls)
+		return 0;
+
 	if (scope == SCOPE_DECL) {
 		if (!level->isalias) {
 			cil_println(indent, "(sensitivity %s)", key);
@@ -2738,6 +2741,9 @@ static int sens_order_to_cil(int indent, struct policydb *pdb,
 	struct ebitmap_node *node;
 	uint32_t i;
 
+	if (!pdb->mls)
+		return 0;
+
 	if (ebitmap_is_empty(&order)) {
 		return 0;
 	}
@@ -2761,6 +2767,9 @@ static int cat_to_cil(int indent, struct policydb *pdb,
 {
 	struct cat_datum *cat = datum;
 
+	if (!pdb->mls)
+		return 0;
+
 	if (scope == SCOPE_REQ) {
 		return 0;
 	}
@@ -2783,6 +2792,9 @@ static int cat_order_to_cil(int indent, struct policydb *pdb,
 	struct ebitmap_node *node;
 	uint32_t i;
 
+	if (!pdb->mls)
+		return 0;
+
 	if (ebitmap_is_empty(&order)) {
 		rc = 0;
 		goto exit;
-- 
2.55.0