[PATCH] libsepol: Do not convert mls rules to CIL for a non-mls policy

[PATCH] libsepol: Do not convert mls rules to CIL for a non-mls policy

[James Carter]

When converting a module policydb to CIL mls rules for sensitivies
and categories are processed if they exist even for a non-mls
policy. This allows for a maliciously crafted policy to cause an
OOB access.

If the policy is not an mls policy, then skip sensitivity,
category, and the ordering rules for sensitivies and categories.

Signed-off-by: James Carter <jwcart2@gmail.com>
---
 libsepol/src/module_to_cil.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/libsepol/src/module_to_cil.c b/libsepol/src/module_to_cil.c
index 06fbdc30..6876bd76 100644
--- a/libsepol/src/module_to_cil.c
+++ b/libsepol/src/module_to_cil.c
@@ -2711,6 +2711,9 @@ static int sens_to_cil(int indent, struct policydb *pdb,
 {
 	level_datum_t *level = datum;
 
+	if (!pdb->mls)
+		return 0;
+
 	if (scope == SCOPE_DECL) {
 		if (!level->isalias) {
 			cil_println(indent, "(sensitivity %s)", key);
@@ -2738,6 +2741,9 @@ static int sens_order_to_cil(int indent, struct policydb *pdb,
 	struct ebitmap_node *node;
 	uint32_t i;
 
+	if (!pdb->mls)
+		return 0;
+
 	if (ebitmap_is_empty(&order)) {
 		return 0;
 	}
@@ -2761,6 +2767,9 @@ static int cat_to_cil(int indent, struct policydb *pdb,
 {
 	struct cat_datum *cat = datum;
 
+	if (!pdb->mls)
+		return 0;
+
 	if (scope == SCOPE_REQ) {
 		return 0;
 	}
@@ -2783,6 +2792,9 @@ static int cat_order_to_cil(int indent, struct policydb *pdb,
 	struct ebitmap_node *node;
 	uint32_t i;
 
+	if (!pdb->mls)
+		return 0;
+
 	if (ebitmap_is_empty(&order)) {
 		rc = 0;
 		goto exit;
-- 
2.55.0

Re: [PATCH] libsepol: Do not convert mls rules to CIL for a non-mls policy

[Stephen Smalley]

On Tue, Aug 4, 2026 at 2:48 PM James Carter <jwcart2@gmail.com> wrote:
>
> When converting a module policydb to CIL mls rules for sensitivies
> and categories are processed if they exist even for a non-mls
> policy. This allows for a maliciously crafted policy to cause an
> OOB access.
>
> If the policy is not an mls policy, then skip sensitivity,
> category, and the ordering rules for sensitivies and categories.
>
> Signed-off-by: James Carter <jwcart2@gmail.com>

Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>

> ---
>  libsepol/src/module_to_cil.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
>
> diff --git a/libsepol/src/module_to_cil.c b/libsepol/src/module_to_cil.c
> index 06fbdc30..6876bd76 100644
> --- a/libsepol/src/module_to_cil.c
> +++ b/libsepol/src/module_to_cil.c
> @@ -2711,6 +2711,9 @@ static int sens_to_cil(int indent, struct policydb *pdb,
>  {
>         level_datum_t *level = datum;
>
> +       if (!pdb->mls)
> +               return 0;
> +
>         if (scope == SCOPE_DECL) {
>                 if (!level->isalias) {
>                         cil_println(indent, "(sensitivity %s)", key);
> @@ -2738,6 +2741,9 @@ static int sens_order_to_cil(int indent, struct policydb *pdb,
>         struct ebitmap_node *node;
>         uint32_t i;
>
> +       if (!pdb->mls)
> +               return 0;
> +
>         if (ebitmap_is_empty(&order)) {
>                 return 0;
>         }
> @@ -2761,6 +2767,9 @@ static int cat_to_cil(int indent, struct policydb *pdb,
>  {
>         struct cat_datum *cat = datum;
>
> +       if (!pdb->mls)
> +               return 0;
> +
>         if (scope == SCOPE_REQ) {
>                 return 0;
>         }
> @@ -2783,6 +2792,9 @@ static int cat_order_to_cil(int indent, struct policydb *pdb,
>         struct ebitmap_node *node;
>         uint32_t i;
>
> +       if (!pdb->mls)
> +               return 0;
> +
>         if (ebitmap_is_empty(&order)) {
>                 rc = 0;
>                 goto exit;
> --
> 2.55.0
>

Re: [PATCH] libsepol: Do not convert mls rules to CIL for a non-mls policy

[Stephen Smalley]

On Tue, Aug 4, 2026 at 3:24 PM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
>
> On Tue, Aug 4, 2026 at 2:48 PM James Carter <jwcart2@gmail.com> wrote:
> >
> > When converting a module policydb to CIL mls rules for sensitivies
> > and categories are processed if they exist even for a non-mls
> > policy. This allows for a maliciously crafted policy to cause an
> > OOB access.
> >
> > If the policy is not an mls policy, then skip sensitivity,
> > category, and the ordering rules for sensitivies and categories.
> >
> > Signed-off-by: James Carter <jwcart2@gmail.com>
>
> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Merged.