Commit 1c91bc84 ("libsepol: reject self flag in type rules in old
policies") actually rejects all type rules in conditionals in modular
policies prior to version 21 (MOD_POLICYDB_VERSION_SELF_TYPETRANS).
The problem is because of fall-through in a switch statement when
the avrule flags are 0. Instead, break rather than fall-through when
avrule flags are 0.
---
libsepol/src/policydb_validate.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
index 9746f562..2043e437 100644
--- a/libsepol/src/policydb_validate.c
+++ b/libsepol/src/policydb_validate.c
@@ -1076,6 +1076,7 @@ static int validate_avrules(sepol_handle_t *handle, const avrule_t *avrule, int
switch(avrule->flags) {
case 0:
+ break;
case RULE_SELF:
if (p->policyvers != POLICY_KERN &&
p->policyvers < MOD_POLICYDB_VERSION_SELF_TYPETRANS &&
--
2.45.2
