tree 66a43e3a1c2895886ec446009b56c5a4db42553c
parent a7a80ef51b915071f0339e5e0262f06d84112874
author James Carter <jwcart2@gmail.com> 1617903131 -0400
committer James Carter <jwcart2@gmail.com> 1618843240 -0400

libsepol/cil: More strict verification of constraint leaf expressions

In constraint expressions u1, u3, r1, r3, t1, and t3 are never
allowed on the right side of an expression, but there were no checks
to verify that they were not used on the right side. The result was
that the expression "(eq t1 t1)" would be silently turned into
"(eq t1 t2)" when the binary policy was created.

Verify that u1, u3, r1, r3, t1, and t3 are not used on the right
side of a constraint expression.

Signed-off-by: James Carter <jwcart2@gmail.com>