High level conclusions

Fuzzers reach 54.11% code coverage.

Fuzzers reach 76.92% of cyclomatic complexity.

Fuzzers reach 73.68% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1837 / 2493

Cyclomatic complexity statically reachable by fuzzers

14630 / 19019

Runtime code coverage of functions

1349 / 2493

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: selabel_file_text-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	110	37.9%
gold	[1:9]	2	0.68%
yellow	[10:29]	10	3.44%
greenyellow	[30:49]	6	2.06%
lawngreen	50+	162	55.8%
All colors	290	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	199	spec_node_cmp	call site: 00199	__errno_location
19	170	spec_node_cmp	call site: 00170	rspec_incomp
17	152	spec_node_cmp	call site: 00152	lspec_incomp
8	190	spec_node_cmp	call site: 00190	__errno_location
6	103	selabel_validate	call site: 00103	__errno_location
4	111	insert_spec	call site: 00111	__errno_location
4	147	spec_node_cmp	call site: 00147	__errno_location
4	233	selabel_sub_key	call site: 00233	selabel_apply_subs
3	31	process_line	call site: 00031	__errno_location
3	85	regex_format_error	call site: 00085	abort
3	255	lookup_check_node	call site: 00255	__errno_location
2	8	write_full	call site: 00008	close

Runtime coverage analysis

Covered functions

42

Functions that are reachable but not covered

37

Reachable functions

65

Percentage of reachable functions covered

43.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libselinux/fuzz/selabel_file_text-fuzzer.c	3
libselinux/src/callbacks.c	1
libselinux/src/label_file.c	17
libselinux/src/./label_file.h	9
libselinux/src/label_support.c	2
libselinux/src/regex.c	5
libselinux/src/matchpathcon.c	1
libselinux/src/label.c	1
libselinux/fuzz/../src/label_file.h	1

Fuzzer: selabel_file_compiled-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	94	26.3%
gold	[1:9]	8	2.24%
yellow	[10:29]	5	1.40%
greenyellow	[30:49]	4	1.12%
lawngreen	50+	246	68.9%
All colors	357	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	246	spec_node_cmp	call site: 00246	__errno_location
19	217	spec_node_cmp	call site: 00217	rspec_incomp
17	199	spec_node_cmp	call site: 00199	lspec_incomp
8	237	spec_node_cmp	call site: 00237	__errno_location
4	194	spec_node_cmp	call site: 00194	__errno_location
4	280	selabel_sub_key	call site: 00280	selabel_apply_subs
3	21	load_mmap	call site: 00021	__errno_location
3	318	regex_format_error	call site: 00318	abort
2	10	write_full	call site: 00010	close
2	119	regex_data_create	call site: 00119	pcre2_serialize_decode_8
2	309	compile_regex	call site: 00309	pthread_mutex_unlock
1	13	convert_data	call site: 00013	close

Runtime coverage analysis

Covered functions

45

Functions that are reachable but not covered

46

Reachable functions

85

Percentage of reachable functions covered

45.88%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libselinux/fuzz/selabel_file_compiled-fuzzer.c	3
libselinux/src/callbacks.c	1
libselinux/src/label_file.c	24
libselinux/src/./label_file.h	5
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
libselinux/src/regex.c	9
libselinux/fuzz/../src/label_file.h	1

Fuzzer: secilc-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	3465	69.6%
gold	[1:9]	294	5.91%
yellow	[10:29]	177	3.55%
greenyellow	[30:49]	324	6.51%
lawngreen	50+	713	14.3%
All colors	4973	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
1631	3306	cil_compile	call site: 03306	cil_build_policydb
342	2840	cil_process_deny_rules_in_ast	call site: 02840	cil_process_deny_rule
74	1750	cil_resolve_call	call site: 01750	cil_fill_levelrange
66	3192	cil_post_verify	call site: 03192	__cil_verify_booleanif
54	2389	__cil_pre_verify_helper	call site: 02389	__cil_verify_map_class
51	1907	cil_resolve_senscat	call site: 01907	cil_resolve_rangetransition
42	3259	__cil_verify_helper	call site: 03259	__cil_verify_avrulex
37	2033	cil_resolve_userprefix	call site: 02033	cil_resolve_context
36	2519	ebitmap_union	call site: 02519	__cil_role_to_bitmap
30	1590	cil_gen_ipaddr	call site: 01590	cil_gen_default
30	1965	cil_resolve_levelrange	call site: 01965	cil_resolve_levelrange
27	2488	ebitmap_init_range	call site: 02488	__cil_expr_to_bitmap_helper

Runtime coverage analysis

Covered functions

549

Functions that are reachable but not covered

658

Reachable functions

1155

Percentage of reachable functions covered

43.03%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libsepol/fuzz/secilc-fuzzer.c	2
libsepol/src/../cil/src/cil_log.c	5
libsepol/src/../cil/src/cil.c	111
libsepol/src/../cil/src/cil_mem.c	5
libsepol/src/../cil/src/cil_strpool.c	6
libsepol/src/hashtab.c	7
libsepol/src/../cil/src/cil_tree.c	13
libsepol/src/../cil/src/cil_symtab.c	13
libsepol/src/symtab.c	3
libsepol/src/../cil/src/cil_list.c	11
libsepol/src/../cil/src/cil_parser.c	7
libsepol/src/../cil/src/cil_stack.c	7
libsepol/src/../cil/src/cil_lexer.l	3
libsepol/src/../cil/src/cil_lexer.c	20
libsepol/src/../cil/src/cil_build_ast.c	202
libsepol/src/../cil/src/cil_verify.c	55
libsepol/src/ebitmap.c	16
libsepol/src/../cil/src/cil_copy_ast.c	4
libsepol/src/../cil/src/cil_resolve_ast.c	97
libsepol/src/../cil/src/cil_reset_ast.c	57
libsepol/src/../cil/src/cil_fqn.c	3
libsepol/src/../cil/src/cil_post.c	75
DESTDIR/usr/include/sepol/policydb/ebitmap.h	4
libsepol/src/../cil/src/cil_deny.c	41
libsepol/src/../cil/src/cil_find.c	16
libsepol/src/polcaps.c	1
libsepol/src/../cil/src/cil_binary.c	138
libsepol/src/policydb_public.c	7
libsepol/src/policydb.c	43
libsepol/src/avrule_block.c	6
libsepol/src/conditional.c	16
libsepol/src/mls.c	5
libsepol/src/avtab.c	11
libsepol/src/util.c	1
DESTDIR/usr/include/sepol/policydb/mls_types.h	8
libsepol/src/constraint.c	2
DESTDIR/usr/include/sepol/policydb/context.h	3
libsepol/src/assertion.c	10
libsepol/src/hierarchy.c	19
libsepol/src/expand.c	11
libsepol/src/optimize.c	16
libsepol/src/write.c	39
libsepol/src/services.c	1

Fuzzer: binpolicy-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1265	41.7%
gold	[1:9]	239	7.88%
yellow	[10:29]	299	9.86%
greenyellow	[30:49]	114	3.76%
lawngreen	50+	1113	36.7%
All colors	3030	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
215	2520	link_modules	call site: 02520	expand_module
187	2741	user_datum_destroy	call site: 02741	copy_and_expand_avrule_block
124	2393	prepare_base	call site: 02393	copy_module
91	833	LLVMFuzzerTestOneInput	call site: 00833	report_assertion_failures
44	2951	constraint_expr_destroy	call site: 02951	sepol_kernel_policydb_to_conf
22	1128	cond_write_node	call site: 01128	expand_cond_av_list
19	2930	constraint_expr_init	call site: 02930	expand_convert_type_set
17	932	sepol_extended_perms_to_string	call site: 00932	sepol_extended_perms_to_string
15	1090	expand_avtab_insert	call site: 01090	expand_avtab_insert
15	1267	mls_write_range_helper	call site: 01267	context_write
15	1290	ocontext_write_xen	call site: 01290	context_write
14	528	range_read	call site: 00528	mls_read_range_helper

Runtime coverage analysis

Covered functions

521

Functions that are reachable but not covered

179

Reachable functions

660

Percentage of reachable functions covered

72.88%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libsepol/fuzz/binpolicy-fuzzer.c	2
libsepol/src/debug.c	1
libsepol/src/policydb.c	87
libsepol/src/symtab.c	4
libsepol/src/hashtab.c	6
libsepol/src/avrule_block.c	8
libsepol/src/conditional.c	25
libsepol/src/ebitmap.c	13
libsepol/src/mls.c	7
DESTDIR/usr/include/sepol/policydb/ebitmap.h	4
libsepol/src/avtab.c	14
libsepol/src/util.c	4
libsepol/src/services.c	3
libsepol/src/./private.h	1
libsepol/src/policydb_validate.c	72
libsepol/src/expand.c	63
DESTDIR/usr/include/sepol/policydb/mls_types.h	9
libsepol/src/context.c	2
DESTDIR/usr/include/sepol/policydb/context.h	5
libsepol/src/polcaps.c	1
libsepol/src/sidtab.c	3
libsepol/src/optimize.c	16
libsepol/src/assertion.c	17
libsepol/src/hierarchy.c	27
libsepol/src/write.c	39
libsepol/src/kernel_to_conf.c	75
libsepol/src/kernel_to_common.c	42
libsepol/src/kernel_to_cil.c	76
libsepol/src/link.c	32
libsepol/src/constraint.c	2

Fuzzer: checkpolicy-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2305	48.3%
gold	[1:9]	181	3.80%
yellow	[10:29]	89	1.86%
greenyellow	[30:49]	34	0.71%
lawngreen	50+	2154	45.2%
All colors	4763	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
330	4396	LLVMFuzzerTestOneInput	call site: 04396	blocks_to_cil
127	2660	sepol_av_to_string	call site: 02660	check_assertions
123	1989	prepare_base	call site: 01989	copy_module
80	2415	copy_and_expand_avrule_block	call site: 02415	convert_and_expand_rule
69	1800	define_genfs_context_helper	call site: 01800	define_genfs_context
63	3255	filename_trans_write	call site: 03255	avrule_block_write
52	2602	bounds_check_types	call site: 02602	bounds_check_type
37	3186	cond_write_list	call site: 03186	cond_write_node
35	1375	insert_separator	call site: 01375	define_user
31	3717	sepol_kernel_policydb_to_conf	call site: 03717	write_cond_av_list_to_conf
22	4201	write_cond_nodes_to_cil	call site: 04201	write_cond_av_list_to_cil
21	625	expand_attrib	call site: 00625	define_type

Runtime coverage analysis

Covered functions

641

Functions that are reachable but not covered

290

Reachable functions

894

Percentage of reachable functions covered

67.56%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
checkpolicy/fuzz/checkpolicy-fuzzer.c	4
libsepol/src/debug.c	1
libsepol/src/policydb.c	61
libsepol/src/symtab.c	4
libsepol/src/hashtab.c	6
libsepol/src/avrule_block.c	9
libsepol/src/conditional.c	22
libsepol/src/ebitmap.c	12
libsepol/src/mls.c	8
DESTDIR/usr/include/sepol/policydb/ebitmap.h	4
libsepol/src/avtab.c	11
libsepol/src/util.c	4
checkpolicy/queue.c	7
checkpolicy/lex.yy.c	18
checkpolicy/policy_define.c	106
checkpolicy/policy_scan.l	5
checkpolicy/y.tab.c	2
checkpolicy/module_compiler.c	40
libsepol/src/policydb_validate.c	72
libsepol/src/expand.c	63
DESTDIR/usr/include/sepol/policydb/mls_types.h	9
DESTDIR/usr/include/sepol/policydb/context.h	6
libsepol/src/constraint.c	2
libsepol/src/context.c	2
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
libsepol/src/polcaps.c	2
libsepol/src/link.c	32
libsepol/src/hierarchy.c	27
libsepol/src/assertion.c	17
libsepol/src/sidtab.c	3
libsepol/src/optimize.c	16
libsepol/src/kernel_to_common.c	42
libsepol/src/write.c	39
libsepol/src/services.c	1
libsepol/src/kernel_to_conf.c	75
libsepol/src/kernel_to_cil.c	76
libsepol/src/module_to_cil.c	71

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
cil_write_policy_conf	/src/selinux/libsepol/src/../cil/src/cil.c	2	['N/A', 'N/A']	16	0	19	3	2	203	0	896	375
cil_write_post_ast	/src/selinux/libsepol/src/../cil/src/cil.c	2	['N/A', 'N/A']	19	0	122	16	8	774	0	4813	290
selabel_file_init	/src/selinux/libselinux/src/label_file.c	3	['N/A', 'N/A', 'int']	6	0	84	8	4	35	0	310	253
selinux_file_context_verify	/src/selinux/libselinux/src/matchpathcon.c	2	['N/A', 'int']	8	0	155	28	11	52	0	244	212
sepol_get_user_sids	/src/selinux/libsepol/src/services.c	4	['int', 'N/A', 'N/A', 'N/A']	8	0	336	46	18	50	0	362	209
sepol_check_context	/src/selinux/libsepol/src/context.c	1	['N/A']	9	0	18	3	2	53	0	328	153
sepol_ppfile_to_module_package	/src/selinux/libsepol/src/module_to_cil.c	2	['N/A', 'N/A']	11	0	251	38	13	262	0	2177	143

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

2021 / 2493

Cyclomatic complexity statically reachable by fuzzers

16233 / 19019

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

libselinux/fuzz/selabel_file_text-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['spec_node_cmp', 'selabel_validate', 'insert_spec', 'selabel_sub_key', 'process_line', 'regex_format_error']

libselinux/fuzz/selabel_file_compiled-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['spec_node_cmp', 'selabel_sub_key', 'load_mmap', 'regex_format_error', 'write_full', 'regex_data_create']

libsepol/fuzz/secilc-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['cil_compile', 'cil_process_deny_rules_in_ast', 'cil_resolve_call', 'cil_post_verify', '__cil_pre_verify_helper', 'cil_resolve_senscat', '__cil_verify_helper', 'cil_resolve_userprefix', 'ebitmap_union', 'cil_gen_ipaddr']

libsepol/fuzz/binpolicy-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['link_modules', 'user_datum_destroy', 'prepare_base', 'LLVMFuzzerTestOneInput', 'constraint_expr_destroy', 'cond_write_node', 'constraint_expr_init', 'sepol_extended_perms_to_string', 'expand_avtab_insert', 'mls_write_range_helper']

checkpolicy/fuzz/checkpolicy-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'sepol_av_to_string', 'prepare_base', 'copy_and_expand_avrule_block', 'define_genfs_context_helper', 'filename_trans_write', 'bounds_check_types', 'cond_write_list', 'insert_separator', 'sepol_kernel_policydb_to_conf']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
init_selinuxmnt	37	14	37.83%	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
spec_node_cmp	209	59	28.22%	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
regex_format_error	55	27	49.09%	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
cil_node_to_string	311	19	6.109%	['secilc-fuzzer']
cil_gen_in	47	25	53.19%	['secilc-fuzzer']
cil_gen_role	35	19	54.28%	['secilc-fuzzer']
cil_gen_type	35	19	54.28%	['secilc-fuzzer']
cil_gen_typeattribute	35	19	54.28%	['secilc-fuzzer']
cil_gen_ibpkeycon	60	32	53.33%	['secilc-fuzzer']
cil_gen_portcon	77	36	46.75%	['secilc-fuzzer']
cil_gen_policycap	35	19	54.28%	['secilc-fuzzer']
__cil_fill_constraint_expr	54	20	37.03%	['secilc-fuzzer']
__cil_fill_constraint_leaf_expr	57	25	43.85%	['secilc-fuzzer']
cil_post_db	110	56	50.90%	['secilc-fuzzer']
__cil_post_db_attr_helper	63	16	25.39%	['secilc-fuzzer']
__cil_expr_to_bitmap	103	31	30.09%	['secilc-fuzzer']
__cil_expr_to_bitmap_helper	34	16	47.05%	['secilc-fuzzer']
__cil_cat_to_bitmap	39	12	30.76%	['secilc-fuzzer']
__cil_post_db_roletype_helper	49	16	32.65%	['secilc-fuzzer']
__cil_post_db_userrole_helper	55	25	45.45%	['secilc-fuzzer']
__cil_post_db_classperms_helper	61	16	26.22%	['secilc-fuzzer']
__cil_post_db_cat_helper	205	84	40.97%	['secilc-fuzzer']
__cil_reset_node	173	62	35.83%	['secilc-fuzzer']
cil_resolve_avrule	52	13	25.0%	['secilc-fuzzer']
cil_resolve_userlevel	43	21	48.83%	['secilc-fuzzer']
cil_resolve_userrange	43	21	48.83%	['secilc-fuzzer']
cil_resolve_levelrange	44	16	36.36%	['secilc-fuzzer']
cil_resolve_context	62	29	46.77%	['secilc-fuzzer']
cil_resolve_nodecon	41	16	39.02%	['secilc-fuzzer']
cil_resolve_expr	84	43	51.19%	['secilc-fuzzer']
__cil_resolve_ast_node	281	136	48.39%	['secilc-fuzzer']
cil_resolve_call	37	20	54.05%	['secilc-fuzzer']
cil_build_call_args	278	10	3.597%	['secilc-fuzzer']
cil_resolve_call_args	123	11	8.943%	['secilc-fuzzer']
__cil_ordered_lists_merge	47	11	23.40%	['secilc-fuzzer']
__cil_ordered_item_insert	32	17	53.12%	['secilc-fuzzer']
cil_verify_name	43	16	37.20%	['secilc-fuzzer']
cil_verify_constraint_leaf_expr_syntax	60	14	23.33%	['secilc-fuzzer']
cil_verify_constraint_expr_syntax	43	21	48.83%	['secilc-fuzzer']
__cil_verify_helper	160	45	28.12%	['secilc-fuzzer']
__cil_pre_verify_helper	39	19	48.71%	['secilc-fuzzer']
__cil_verify_user_pre_eval	33	8	24.24%	['secilc-fuzzer']
cond_insertf	56	27	48.21%	['binpolicy-fuzzer']
type_set_expand	83	45	54.21%	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
expand_avtab_node	48	17	35.41%	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
expand_avtab_insert	52	16	30.76%	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
sepol_kernel_policydb_to_cil	221	119	53.84%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_default_range_to_cil	31	13	41.93%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_type_neveraudit_rules_to_cil	33	17	51.51%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
cond_expr_to_str	77	23	29.87%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_role_transition_rules_to_cil	31	16	51.61%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_selinux_port_rules_to_cil	45	14	31.11%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_selinux_ibpkey_rules_to_cil	45	16	35.55%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_xen_ioport_rules_to_cil	34	13	38.23%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_xen_iomem_rules_to_cil	34	13	38.23%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
sepol_kernel_policydb_to_conf	226	122	53.98%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_default_range_to_conf	31	13	41.93%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_type_neveraudit_rules_to_conf	33	17	51.51%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_role_transition_rules_to_conf	31	16	51.61%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_selinux_port_rules_to_conf	45	14	31.11%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_selinux_ibpkey_rules_to_conf	46	16	34.78%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_xen_iomem_rules_to_conf	34	13	38.23%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_xen_ioport_rules_to_conf	34	13	38.23%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
link_modules	83	28	33.73%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
roles_init	32	16	50.0%	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
range_read	83	15	18.07%	['binpolicy-fuzzer']
validate_cond_expr	41	15	36.58%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
validate_avrules	75	5	6.666%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
validate_ocontexts	76	39	51.31%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
role_trans_write	40	16	40.0%	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
role_trans_rule_write	37	14	37.83%	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
filename_trans_rule_write	42	12	28.57%	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
ocontext_write_selinux	122	55	45.08%	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
ocontext_write_xen	104	29	27.88%	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
define_policy	44	15	34.09%	['checkpolicy-fuzzer']
require_class	94	46	48.93%	['checkpolicy-fuzzer']
define_permissive	33	17	51.51%	['checkpolicy-fuzzer']
define_common_perms	84	39	46.42%	['checkpolicy-fuzzer']
define_av_perms	99	37	37.37%	['checkpolicy-fuzzer']
define_sens	134	47	35.07%	['checkpolicy-fuzzer']
define_category	123	27	21.95%	['checkpolicy-fuzzer']
define_level	93	37	39.78%	['checkpolicy-fuzzer']
expand_attrib	65	17	26.15%	['checkpolicy-fuzzer']
define_typeattribute	59	25	42.37%	['checkpolicy-fuzzer']
define_type	68	35	51.47%	['checkpolicy-fuzzer']
define_bool_tunable	66	30	45.45%	['checkpolicy-fuzzer']
define_roleattribute	53	28	52.83%	['checkpolicy-fuzzer']
define_pirq_context	39	7	17.94%	['checkpolicy-fuzzer']
define_iomem_context	48	7	14.58%	['checkpolicy-fuzzer']
define_ioport_context	48	7	14.58%	['checkpolicy-fuzzer']
define_pcidevice_context	40	7	17.5%	['checkpolicy-fuzzer']
define_devicetree_context	44	8	18.18%	['checkpolicy-fuzzer']
define_port_context	77	28	36.36%	['checkpolicy-fuzzer']
define_ibpkey_context	86	38	44.18%	['checkpolicy-fuzzer']
define_ibendport_context	63	11	17.46%	['checkpolicy-fuzzer']
define_netif_context	50	19	38.0%	['checkpolicy-fuzzer']
define_fs_use	43	8	18.60%	['checkpolicy-fuzzer']
define_range_trans	103	52	50.48%	['checkpolicy-fuzzer']
add_aliases_to_type	58	28	48.27%	['checkpolicy-fuzzer']
avrule_sort_xperms	40	20	50.0%	['checkpolicy-fuzzer']
define_genfs_context_helper	139	17	12.23%	['checkpolicy-fuzzer']
copy_and_expand_avrule_block	62	28	45.16%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
copy_role_trans	77	11	14.28%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
expand_filename_trans	42	10	23.80%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
expand_range_trans	41	10	24.39%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
cond_node_copy	46	5	10.86%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
discard_tunables	66	18	27.27%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
expand_attributes_in_attributes	43	23	53.48%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
class_copy_callback	71	31	43.66%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
class_copy_default_new_object	31	16	51.61%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
ocontext_copy_selinux	88	40	45.45%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
ocontext_copy_xen	62	30	48.38%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
genfs_copy	47	7	14.89%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/selinux/libsepol/src/debug.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_binary.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/enabled.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_tree.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/fuzz/selabel_file_compiled-fuzzer.c	['selabel_file_compiled-fuzzer']	['selabel_file_compiled-fuzzer']
/src/selinux/checkpolicy/y.tab.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/policydb.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/sidtab.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/link.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/check_context.c	[]	[]
/src/selinux/libsepol/src/module.c	[]	[]
/src/selinux/libsepol/src/optimize.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/usr/include/x86_64-linux-gnu/bits/uintn-identity.h	[]	[]
/src/selinux/libsepol/src/avtab.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_policy.c	[]	[]
/src/selinux/libselinux/src/policyvers.c	[]	[]
/src/selinux/libsepol/src/./private.h	['binpolicy-fuzzer']	[]
/src/selinux/libselinux/src/callbacks.c	['selabel_file_text-fuzzer', 'selabel_file_compiled-fuzzer']	['selabel_file_text-fuzzer', 'selabel_file_compiled-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_copy_ast.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_lexer.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_strpool.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/polcaps.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_mem.c	['secilc-fuzzer']	[]
/src/selinux/checkpolicy/policy_define.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/checkpolicy/module_compiler.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/policydb_convert.c	[]	[]
/src/selinux/libsepol/src/kernel_to_common.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/selinux_config.c	[]	[]
/src/selinux/libsepol/fuzz/secilc-fuzzer.c	['secilc-fuzzer']	['secilc-fuzzer']
/src/selinux/checkpolicy/lex.yy.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/checkpolicy/queue.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libselinux/src/regex.c	['selabel_file_text-fuzzer', 'selabel_file_compiled-fuzzer']	['selabel_file_text-fuzzer', 'selabel_file_compiled-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_write_ast.c	[]	[]
/src/selinux/checkpolicy/fuzz/checkpolicy-fuzzer.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libselinux/src/./selinux_internal.h	[]	[]
/src/selinux/libsepol/src/assertion.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_stack.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/canonicalize_context.c	[]	[]
/src/selinux/libselinux/src/label_x.c	[]	[]
/src/selinux/libselinux/src/lsetfilecon.c	[]	[]
/src/selinux/libsepol/src/ebitmap.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/context.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_log.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/policydb_public.c	['secilc-fuzzer']	['secilc-fuzzer']
/src/selinux/DESTDIR/usr/include/sepol/policydb/mls_types.h	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/label_support.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_post.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_list.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_deny.c	['secilc-fuzzer']	[]
/src/selinux/checkpolicy/parse_util.c	[]	[]
/src/selinux/libsepol/src/hierarchy.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/context_record.c	[]	[]
/src/selinux/DESTDIR/usr/include/sepol/policydb/context.h	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/checkpolicy/policy_scan.l	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libselinux/fuzz/selabel_file_text-fuzzer.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/libselinux/src/selinux_internal.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/freecon.c	[]	[]
/src/selinux/libselinux/src/lgetfilecon.c	[]	[]
/src/selinux/DESTDIR/usr/include/sepol/policydb/ebitmap.h	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_build_ast.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/kernel_to_cil.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/sha1.c	[]	[]
/src/selinux/libselinux/src/label_media.c	[]	[]
/src/selinux/libselinux/src/label_file.c	['selabel_file_text-fuzzer', 'selabel_file_compiled-fuzzer']	['selabel_file_text-fuzzer', 'selabel_file_compiled-fuzzer']
/src/selinux/libselinux/src/init.c	[]	[]
/src/selinux/libselinux/src/./label_file.h	['selabel_file_text-fuzzer', 'selabel_file_compiled-fuzzer']	[]
/src/selinux/libsepol/src/module_to_cil.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/hashtab.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_fqn.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_symtab.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/symtab.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_lexer.l	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/util.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/seusers.c	[]	[]
/src/selinux/libselinux/src/setrans_client.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_parser.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/expand.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/conditional.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/matchpathcon.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/libsepol/src/policydb_validate.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/label_db.c	[]	[]
/src/selinux/libsepol/src/kernel_to_conf.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_reset_ast.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/services.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_verify.c	['secilc-fuzzer']	[]
/usr/include/x86_64-linux-gnu/bits/byteswap.h	['selabel_file_compiled-fuzzer', 'checkpolicy-fuzzer']	[]
/src/selinux/libsepol/src/constraint.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/write.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_resolve_ast.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_find.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/label.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/libsepol/fuzz/binpolicy-fuzzer.c	['binpolicy-fuzzer']	['binpolicy-fuzzer']
/src/selinux/libsepol/src/mls.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/avrule_block.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']

Directories in report

Directory
/src/selinux/libselinux/src/
/src/selinux/libsepol/fuzz/
/usr/include/x86_64-linux-gnu/bits/
/src/selinux/libsepol/src/../cil/src/
/src/selinux/checkpolicy/fuzz/
/src/selinux/libselinux/src/./
/src/selinux/libsepol/src/./
/src/selinux/DESTDIR/usr/include/sepol/policydb/
/src/selinux/libsepol/src/
/src/selinux/checkpolicy/
/src/selinux/libselinux/fuzz/