[WIP] checkpolicy: validate generated policies

After generating policies validate them. Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
cgzones · Jul 1, 2023 · 648acf9 · 648acf9
1 parent d68d2e4
commit 648acf9
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 0 deletions.
diff --git a/checkpolicy/checkmodule.c b/checkpolicy/checkmodule.c
@@ -29,6 +29,7 @@
 #include <sepol/policydb/expand.h>
 #include <sepol/policydb/link.h>
 #include <sepol/policydb/sidtab.h>
+#include <sepol/policydb/validate.h>
 
 #include "queue.h"
 #include "checkpolicy.h"
@@ -334,6 +335,14 @@ int main(int argc, char **argv)
 
 	sepol_sidtab_destroy(&sidtab);
 
+	modpolicydb.policyvers = policyvers;
+
+	if (policydb_validate(NULL, &modpolicydb)) {
+		fprintf(stderr, "%s:  validation of generated policy failed\n", argv[0]);
+		exit(1);
+	}
+	printf("%s:  validation of generated policy succeeded\n", argv[0]);
+
 	if (outfile) {
 		FILE *outfp = fopen(outfile, "w");
 

diff --git a/checkpolicy/checkpolicy.c b/checkpolicy/checkpolicy.c
@@ -87,6 +87,7 @@
 #include <sepol/policydb/hierarchy.h>
 #include <sepol/policydb/expand.h>
 #include <sepol/policydb/link.h>
+#include <sepol/policydb/validate.h>
 
 #include "queue.h"
 #include "checkpolicy.h"
@@ -656,6 +657,12 @@ int main(int argc, char **argv)
 		}
 	}
 
+	if (policydb_validate(NULL, policydbp)) {
+		fprintf(stderr, "%s:  validation of generated policy failed\n", argv[0]);
+		exit(1);
+	}
+	printf("%s:  validation of generated policy succeeded\n", argv[0]);
+
 	if (outfile) {
 		if (!strcmp(outfile, "-")) {
 			outfp = stdout;