Christian Göttsche <cgzones@xxxxxxxxxxxxxx> writes:
> On Fri, 14 Jun 2024 at 21:45, James Carter <jwcart2@xxxxxxxxx> wrote:
>>
>> Commit 1c91bc84 ("libsepol: reject self flag in type rules in old
>> policies") actually rejects all type rules in conditionals in modular
>> policies prior to version 21 (MOD_POLICYDB_VERSION_SELF_TYPETRANS).
>>
>> The problem is because of fall-through in a switch statement when
>> the avrule flags are 0. Instead, break rather than fall-through when
>> avrule flags are 0.
>
> Thanks for spotting this.
> I'am probably going to look to enhance the downgrade unit test for the
> next validate updates...
>
> Reviewed-by: Christian Göttsche <cgzones@xxxxxxxxxxxxxx>
Acked-by: Petr Lautrbach <lautrbach@xxxxxxxxxx>
>
>> ---
>> libsepol/src/policydb_validate.c | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
>> index 9746f562..2043e437 100644
>> --- a/libsepol/src/policydb_validate.c
>> +++ b/libsepol/src/policydb_validate.c
>> @@ -1076,6 +1076,7 @@ static int validate_avrules(sepol_handle_t *handle, const avrule_t *avrule, int
>>
>> switch(avrule->flags) {
>> case 0:
>> + break;
>> case RULE_SELF:
>> if (p->policyvers != POLICY_KERN &&
>> p->policyvers < MOD_POLICYDB_VERSION_SELF_TYPETRANS &&
>> --
>> 2.45.2
>>
