selinux/libsepol
Christian Göttsche d2d24b9331 libsepol: more strict validation
Validate that

  - each constraint has at least one expression
  - classes reference a valid common class identifier
  - the role flavor is either ROLE or ATTRIB
  - types reference a valid primary identifier
  - types refer to a raw type, not an attribute, as bounds
  - extended permissions in avtabs have a valid specifier
  - type av rules refer to a raw type (e.g. type_transition)
  - conditionals have at least one expression
  - the state and flags of conditionals are valid
  - filename transitions have at least one datum
  - low ports are not bigger than high ones in port ocontexts
  - genfs declarations refer to a valid class identifier
  - genfs declarations contains a filesystem name
  - filename transitions refer to a raw type
  - permissive types are raw ones
  - the range transition hashmap is valid
  - the type-attribute-maps are valid

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Acked-by: James Carter <jwcart2@gmail.com>
2022-08-09 09:52:44 -04:00
..
cil libsepol/cil: use ebitmap_init_range 2022-08-09 09:52:15 -04:00
fuzz libsepol: add libfuzz based fuzzer for reading binary policies 2021-12-15 12:48:28 -05:00
include libsepol: support const avtab_t pointer in avtab_map() 2022-08-09 09:52:34 -04:00
man selinux: Update manpages after removing legacy boolean and user code 2019-07-29 23:46:47 +02:00
src libsepol: more strict validation 2022-08-09 09:52:44 -04:00
tests libsepol: add ebitmap_init_range 2022-08-09 09:52:13 -04:00
utils libsepol/utils: improve wording 2022-07-06 15:57:24 -04:00
.gitignore libsepol: add policy utilities 2022-04-12 13:09:19 -04:00
COPYING initial import from svn trunk revision 2950 2008-08-19 15:30:36 -04:00
Makefile libsepol: build cil into libsepol 2014-08-26 08:03:31 -04:00
VERSION Update VERSIONs to 3.4 for release. 2022-05-18 16:51:03 +02:00