validate not self rules

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
cgzones · Aug 30, 2022 · c5a77e5 · c5a77e5
1 parent 528399a
commit c5a77e5
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
@@ -918,6 +918,15 @@ static int validate_avrules(sepol_handle_t *handle, const avrule_t *avrule, int
 		case 0:
 		case RULE_SELF:
 			break;
+		case RULE_NOTSELF:
+			switch(avrule->specified) {
+			case AVRULE_NEVERALLOW:
+			case AVRULE_XPERMS_NEVERALLOW:
+				break;
+			default:
+				goto bad;
+			}
+			break;
 		default:
 			goto bad;
 		}