[PATCH] selinux: reject a policy that both rejects and allows unknown classes

[PATCH] selinux: reject a policy that both rejects and allows unknown classes

[Christian Göttsche]

From: Christian Göttsche <cgzones@googlemail.com>

handle-unknown is a single three-valued choice - deny, reject or allow -
but the policydb header spells it as two independent bits and
policydb_read() takes any combination of them.

libsepol writes exactly one of the three values
(POLICYDB_CONFIG_UNKNOWN_MASK & p->handle_unknown), so no policy built by
the reference toolchain carries this combination.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 security/selinux/ss/policydb.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 4342258cb148..7eeaf7076c52 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -2844,7 +2844,8 @@ int policydb_read(struct policydb *p, struct policy_file *fp)
 		goto bad;
 	}
 
-	if ((le32_to_cpu(buf[1]) & POLICYDB_CONFIG_MLS)) {
+	val = le32_to_cpu(buf[1]);
+	if (val & POLICYDB_CONFIG_MLS) {
 		p->mls_enabled = 1;
 
 		rc = -EINVAL;
@@ -2855,8 +2856,13 @@ int policydb_read(struct policydb *p, struct policy_file *fp)
 			goto bad;
 		}
 	}
-	p->reject_unknown = !!(le32_to_cpu(buf[1]) & REJECT_UNKNOWN);
-	p->allow_unknown = !!(le32_to_cpu(buf[1]) & ALLOW_UNKNOWN);
+	rc = -EINVAL;
+	if ((val & (REJECT_UNKNOWN | ALLOW_UNKNOWN)) == (REJECT_UNKNOWN | ALLOW_UNKNOWN)) {
+		pr_err("SELinux:  policydb configuration both rejects and allows unknown classes and permissions\n");
+		goto bad;
+	}
+	p->reject_unknown = !!(val & REJECT_UNKNOWN);
+	p->allow_unknown = !!(val & ALLOW_UNKNOWN);
 
 	if (p->policyvers >= POLICYDB_VERSION_POLCAP) {
 		rc = ebitmap_read(&p->policycaps, fp);
-- 
2.55.0

Re: [PATCH] selinux: reject a policy that both rejects and allows unknown classes

[sashiko-bot]

> From: Christian Göttsche <cgzones@googlemail.com>
> 
> handle-unknown is a single three-valued choice - deny, reject or allow -
> but the policydb header spells it as two independent bits and
> policydb_read() takes any combination of them.
> 
> libsepol writes exactly one of the three values
> (POLICYDB_CONFIG_UNKNOWN_MASK & p->handle_unknown), so no policy built by
> the reference toolchain carries this combination.
> 
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917142038.60637-1-cgoettsche@seltendoof.de?part=1

Re: [PATCH] selinux: reject a policy that both rejects and allows unknown classes

[Stephen Smalley]

On Thu, Sep 17, 2026 at 10:20 AM Christian Göttsche
<cgoettsche@seltendoof.de> wrote:
>
> From: Christian Göttsche <cgzones@googlemail.com>
>
> handle-unknown is a single three-valued choice - deny, reject or allow -
> but the policydb header spells it as two independent bits and
> policydb_read() takes any combination of them.
>
> libsepol writes exactly one of the three values
> (POLICYDB_CONFIG_UNKNOWN_MASK & p->handle_unknown), so no policy built by
> the reference toolchain carries this combination.
>
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>

Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Re: [PATCH] selinux: reject a policy that both rejects and allows unknown classes

[Paul Moore]

On Sep 17, 2026 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@seltendoof.de> wrote:
> 
> handle-unknown is a single three-valued choice - deny, reject or allow -
> but the policydb header spells it as two independent bits and
> policydb_read() takes any combination of them.
> 
> libsepol writes exactly one of the three values
> (POLICYDB_CONFIG_UNKNOWN_MASK & p->handle_unknown), so no policy built by
> the reference toolchain carries this combination.
> 
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> ---
>  security/selinux/ss/policydb.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)

Merged into selinux/dev, thanks.

--
paul-moore.com