High level conclusions

Fuzzers reach 71.84% code coverage.

Fuzzers reach 76.78% of cyclomatic complexity.

Fuzzers reach 73.68% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1837 / 2493

Cyclomatic complexity statically reachable by fuzzers

14625 / 19047

Runtime code coverage of functions

1791 / 2493

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: selabel_file_compiled-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	98	26.9%
gold	[1:9]	19	5.21%
yellow	[10:29]	2	0.54%
greenyellow	[30:49]	22	6.04%
lawngreen	50+	223	61.2%
All colors	364	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	246	spec_node_cmp	call site: 00246	__errno_location
19	217	spec_node_cmp	call site: 00217	rspec_incomp
17	199	spec_node_cmp	call site: 00199	lspec_incomp
8	237	spec_node_cmp	call site: 00237	__errno_location
4	194	spec_node_cmp	call site: 00194	__errno_location
4	280	selabel_sub_key	call site: 00280	selabel_apply_subs
3	21	load_mmap	call site: 00021	__errno_location
3	318	regex_format_error	call site: 00318	abort
2	10	write_full	call site: 00010	close
2	119	regex_data_create	call site: 00119	pcre2_serialize_decode_8
2	309	compile_regex	call site: 00309	pthread_mutex_unlock
2	344	all_node_specs	call site: 00344	all_node_specs

Runtime coverage analysis

Covered functions

46

Functions that are reachable but not covered

46

Reachable functions

86

Percentage of reachable functions covered

46.51%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libselinux/fuzz/selabel_file_compiled-fuzzer.c	3
libselinux/src/callbacks.c	1
libselinux/src/label_file.c	25
libselinux/src/./label_file.h	5
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
libselinux/src/regex.c	9
libselinux/fuzz/../src/label_file.h	1

Fuzzer: selabel_file_text-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	113	38.4%
gold	[1:9]	7	2.38%
yellow	[10:29]	11	3.74%
greenyellow	[30:49]	3	1.02%
lawngreen	50+	160	54.4%
All colors	294	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	195	spec_node_cmp	call site: 00195	__errno_location
19	166	spec_node_cmp	call site: 00166	rspec_incomp
17	148	spec_node_cmp	call site: 00148	lspec_incomp
8	186	spec_node_cmp	call site: 00186	__errno_location
6	99	selabel_validate	call site: 00099	__errno_location
4	107	insert_spec	call site: 00107	__errno_location
4	143	spec_node_cmp	call site: 00143	__errno_location
4	229	selabel_sub_key	call site: 00229	selabel_apply_subs
3	31	process_line	call site: 00031	__errno_location
3	81	regex_format_error	call site: 00081	abort
3	251	lookup_check_node	call site: 00251	__errno_location
2	8	write_full	call site: 00008	close

Runtime coverage analysis

Covered functions

43

Functions that are reachable but not covered

37

Reachable functions

66

Percentage of reachable functions covered

43.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libselinux/fuzz/selabel_file_text-fuzzer.c	3
libselinux/src/callbacks.c	1
libselinux/src/label_file.c	18
libselinux/src/./label_file.h	9
libselinux/src/label_support.c	2
libselinux/src/regex.c	5
libselinux/src/matchpathcon.c	1
libselinux/src/label.c	1
libselinux/fuzz/../src/label_file.h	1

Fuzzer: binpolicy-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1029	33.9%
gold	[1:9]	122	4.02%
yellow	[10:29]	58	1.91%
greenyellow	[30:49]	111	3.65%
lawngreen	50+	1714	56.4%
All colors	3034	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
186	2747	user_datum_destroy	call site: 02747	copy_and_expand_avrule_block
127	2614	expand_attributes_in_attributes	call site: 02614	policydb_index_others
124	2395	prepare_base	call site: 02395	copy_module
60	835	check_assertion	call site: 00835	check_assertion_extended_permissions
44	2956	constraint_expr_destroy	call site: 02956	sepol_kernel_policydb_to_conf
26	897	check_assertion	call site: 00897	report_assertion_failures
22	1127	cond_write_node	call site: 01127	expand_cond_av_list
19	2935	constraint_expr_init	call site: 02935	expand_convert_type_set
17	931	sepol_extended_perms_to_string	call site: 00931	sepol_extended_perms_to_string
17	2596	expand_attributes_in_attributes	call site: 02596	ebitmap_union
15	1089	expand_avtab_insert	call site: 01089	expand_avtab_insert
13	2529	is_decl_requires_met	call site: 02529	is_perm_existent

Runtime coverage analysis

Covered functions

551

Functions that are reachable but not covered

149

Reachable functions

659

Percentage of reachable functions covered

77.39%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libsepol/fuzz/binpolicy-fuzzer.c	2
libsepol/src/debug.c	1
libsepol/src/policydb.c	87
libsepol/src/symtab.c	4
libsepol/src/hashtab.c	6
libsepol/src/avrule_block.c	8
libsepol/src/conditional.c	25
libsepol/src/ebitmap.c	13
libsepol/src/mls.c	7
DESTDIR/usr/include/sepol/policydb/ebitmap.h	4
libsepol/src/avtab.c	14
libsepol/src/util.c	4
libsepol/src/services.c	3
libsepol/src/./private.h	1
libsepol/src/policydb_validate.c	71
libsepol/src/expand.c	63
DESTDIR/usr/include/sepol/policydb/mls_types.h	9
libsepol/src/context.c	2
DESTDIR/usr/include/sepol/policydb/context.h	5
libsepol/src/polcaps.c	1
libsepol/src/sidtab.c	3
libsepol/src/optimize.c	16
libsepol/src/assertion.c	17
libsepol/src/hierarchy.c	27
libsepol/src/write.c	39
libsepol/src/kernel_to_conf.c	75
libsepol/src/kernel_to_common.c	42
libsepol/src/kernel_to_cil.c	76
libsepol/src/link.c	32
libsepol/src/constraint.c	2

Fuzzer: checkpolicy-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2258	47.1%
gold	[1:9]	152	3.17%
yellow	[10:29]	105	2.19%
greenyellow	[30:49]	45	0.93%
lawngreen	50+	2229	46.5%
All colors	4789	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
327	4426	LLVMFuzzerTestOneInput	call site: 04426	blocks_to_cil
127	2691	sepol_av_to_string	call site: 02691	check_assertions
124	2016	prepare_base	call site: 02016	copy_module
79	2447	copy_and_expand_avrule_block	call site: 02447	convert_and_expand_rule
63	3284	filename_trans_write	call site: 03284	avrule_block_write
52	2633	bounds_check_types	call site: 02633	bounds_check_type
50	1847	define_genfs_context_helper	call site: 01847	define_genfs_context
37	3215	cond_write_list	call site: 03215	cond_write_node
35	1389	insert_separator	call site: 01389	define_user
31	3749	sepol_kernel_policydb_to_conf	call site: 03749	write_cond_av_list_to_conf
23	1624	define_devicetree_context	call site: 01624	define_port_context
22	4233	write_cond_nodes_to_cil	call site: 04233	write_cond_av_list_to_cil

Runtime coverage analysis

Covered functions

642

Functions that are reachable but not covered

288

Reachable functions

893

Percentage of reachable functions covered

67.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
checkpolicy/fuzz/checkpolicy-fuzzer.c	4
libsepol/src/debug.c	1
libsepol/src/policydb.c	61
libsepol/src/symtab.c	4
libsepol/src/hashtab.c	6
libsepol/src/avrule_block.c	9
libsepol/src/conditional.c	22
libsepol/src/ebitmap.c	12
libsepol/src/mls.c	8
DESTDIR/usr/include/sepol/policydb/ebitmap.h	4
libsepol/src/avtab.c	11
libsepol/src/util.c	4
checkpolicy/queue.c	7
checkpolicy/lex.yy.c	18
checkpolicy/policy_define.c	106
checkpolicy/policy_scan.l	5
checkpolicy/y.tab.c	2
checkpolicy/module_compiler.c	40
libsepol/src/policydb_validate.c	71
libsepol/src/expand.c	63
DESTDIR/usr/include/sepol/policydb/mls_types.h	9
DESTDIR/usr/include/sepol/policydb/context.h	6
libsepol/src/constraint.c	2
libsepol/src/context.c	2
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
libsepol/src/polcaps.c	2
libsepol/src/link.c	32
libsepol/src/hierarchy.c	27
libsepol/src/assertion.c	17
libsepol/src/sidtab.c	3
libsepol/src/optimize.c	16
libsepol/src/kernel_to_common.c	42
libsepol/src/write.c	39
libsepol/src/services.c	1
libsepol/src/kernel_to_conf.c	75
libsepol/src/kernel_to_cil.c	76
libsepol/src/module_to_cil.c	71

Fuzzer: secilc-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	755	15.1%
gold	[1:9]	331	6.65%
yellow	[10:29]	162	3.25%
greenyellow	[30:49]	42	0.84%
lawngreen	50+	3685	74.0%
All colors	4975	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
57	4811	filename_write_one	call site: 04811	avrule_block_write
35	4309	check_assertion_self_match	call site: 04309	check_assertion_extended_permissions
26	4693	policydb_write	call site: 04693	expand_avtab
24	4358	__cil_print_classperm	call site: 04358	__cil_print_permissionx
22	4741	cond_write_node	call site: 04741	expand_cond_av_list
21	4560	role_set_expand	call site: 04560	mls_semantic_range_expand
20	4009	__cil_avrulex_to_hashtable_helper	call site: 04009	__cil_avrulex_to_hashtable_helper
17	310	cil_yylex	call site: 00310	cil_yyrestart
17	4900	ocontext_write_selinux	call site: 04900	ocontext_write_xen
16	4234	cil_ibendportcon_to_policydb	call site: 04234	cil_devicetreecon_to_policydb
14	291	cil_parser	call site: 00291	cil_yylex
12	4541	role_set_expand	call site: 04541	map_ebitmap

Runtime coverage analysis

Covered functions

1147

Functions that are reachable but not covered

117

Reachable functions

1155

Percentage of reachable functions covered

89.87%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libsepol/fuzz/secilc-fuzzer.c	2
libsepol/src/../cil/src/cil_log.c	5
libsepol/src/../cil/src/cil.c	111
libsepol/src/../cil/src/cil_mem.c	5
libsepol/src/../cil/src/cil_strpool.c	6
libsepol/src/hashtab.c	7
libsepol/src/../cil/src/cil_tree.c	13
libsepol/src/../cil/src/cil_symtab.c	13
libsepol/src/symtab.c	3
libsepol/src/../cil/src/cil_list.c	11
libsepol/src/../cil/src/cil_parser.c	7
libsepol/src/../cil/src/cil_stack.c	7
libsepol/src/../cil/src/cil_lexer.l	3
libsepol/src/../cil/src/cil_lexer.c	20
libsepol/src/../cil/src/cil_build_ast.c	202
libsepol/src/../cil/src/cil_verify.c	55
libsepol/src/ebitmap.c	16
libsepol/src/../cil/src/cil_copy_ast.c	4
libsepol/src/../cil/src/cil_resolve_ast.c	97
libsepol/src/../cil/src/cil_reset_ast.c	57
libsepol/src/../cil/src/cil_fqn.c	3
libsepol/src/../cil/src/cil_post.c	75
DESTDIR/usr/include/sepol/policydb/ebitmap.h	4
libsepol/src/../cil/src/cil_deny.c	41
libsepol/src/../cil/src/cil_find.c	16
libsepol/src/polcaps.c	1
libsepol/src/../cil/src/cil_binary.c	138
libsepol/src/policydb_public.c	7
libsepol/src/policydb.c	43
libsepol/src/avrule_block.c	6
libsepol/src/conditional.c	16
libsepol/src/mls.c	5
libsepol/src/avtab.c	11
libsepol/src/util.c	1
DESTDIR/usr/include/sepol/policydb/mls_types.h	8
libsepol/src/constraint.c	2
DESTDIR/usr/include/sepol/policydb/context.h	3
libsepol/src/assertion.c	10
libsepol/src/hierarchy.c	19
libsepol/src/expand.c	11
libsepol/src/optimize.c	16
libsepol/src/write.c	39
libsepol/src/services.c	1

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
cil_write_policy_conf	/src/selinux/libsepol/src/../cil/src/cil.c	2	['N/A', 'N/A']	16	0	19	3	2	203	0	896	375
cil_write_post_ast	/src/selinux/libsepol/src/../cil/src/cil.c	2	['N/A', 'N/A']	19	0	122	16	8	774	0	4814	290
selabel_file_init	/src/selinux/libselinux/src/label_file.c	3	['N/A', 'N/A', 'int']	6	0	84	8	4	35	0	309	252
selinux_file_context_verify	/src/selinux/libselinux/src/matchpathcon.c	2	['N/A', 'int']	8	0	155	28	11	52	0	244	212
sepol_get_user_sids	/src/selinux/libsepol/src/services.c	4	['int', 'N/A', 'N/A', 'N/A']	8	0	336	46	18	50	0	362	209
sepol_check_context	/src/selinux/libsepol/src/context.c	1	['N/A']	9	0	18	3	2	53	0	328	153
sepol_ppfile_to_module_package	/src/selinux/libsepol/src/module_to_cil.c	2	['N/A', 'N/A']	11	0	251	38	13	261	0	2168	143

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

2021 / 2493

Cyclomatic complexity statically reachable by fuzzers

16227 / 19047

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

libselinux/fuzz/selabel_file_compiled-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['spec_node_cmp', 'selabel_sub_key', 'load_mmap', 'regex_format_error', 'write_full', 'regex_data_create']

libselinux/fuzz/selabel_file_text-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['spec_node_cmp', 'selabel_validate', 'insert_spec', 'selabel_sub_key', 'process_line', 'regex_format_error']

libsepol/fuzz/binpolicy-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['user_datum_destroy', 'expand_attributes_in_attributes', 'prepare_base', 'check_assertion', 'constraint_expr_destroy', 'cond_write_node', 'constraint_expr_init', 'sepol_extended_perms_to_string']

checkpolicy/fuzz/checkpolicy-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['LLVMFuzzerTestOneInput', 'sepol_av_to_string', 'prepare_base', 'copy_and_expand_avrule_block', 'filename_trans_write', 'bounds_check_types', 'define_genfs_context_helper', 'cond_write_list', 'insert_separator', 'sepol_kernel_policydb_to_conf']

libsepol/fuzz/secilc-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['filename_write_one', 'check_assertion_self_match', 'policydb_write', '__cil_print_classperm', 'cond_write_node', 'role_set_expand', '__cil_avrulex_to_hashtable_helper', 'cil_yylex', 'ocontext_write_selinux', 'cil_ibendportcon_to_policydb']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
init_selinuxmnt	37	14	37.83%	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
spec_node_cmp	209	59	28.22%	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
regex_format_error	55	27	49.09%	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
discard_tunables	62	18	29.03%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
expand_avtab_node	48	17	35.41%	['checkpolicy-fuzzer', 'secilc-fuzzer', 'binpolicy-fuzzer']
expand_avtab_insert	52	16	30.76%	['checkpolicy-fuzzer', 'secilc-fuzzer', 'binpolicy-fuzzer']
sepol_kernel_policydb_to_cil	221	119	53.84%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_type_neveraudit_rules_to_cil	33	17	51.51%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_selinux_port_rules_to_cil	45	14	31.11%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_xen_ioport_rules_to_cil	34	13	38.23%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_xen_iomem_rules_to_cil	34	13	38.23%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
sepol_kernel_policydb_to_conf	226	122	53.98%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_type_neveraudit_rules_to_conf	33	17	51.51%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_selinux_port_rules_to_conf	45	14	31.11%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_xen_iomem_rules_to_conf	34	13	38.23%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_xen_ioport_rules_to_conf	34	13	38.23%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
link_modules	83	28	33.73%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
roles_init	32	16	50.0%	['checkpolicy-fuzzer', 'secilc-fuzzer', 'binpolicy-fuzzer']
avrule_write	84	26	30.95%	['checkpolicy-fuzzer', 'secilc-fuzzer', 'binpolicy-fuzzer']
filename_trans_rule_write	42	12	28.57%	['checkpolicy-fuzzer', 'secilc-fuzzer', 'binpolicy-fuzzer']
ocontext_write_xen	104	35	33.65%	['checkpolicy-fuzzer', 'secilc-fuzzer', 'binpolicy-fuzzer']
define_policy	44	15	34.09%	['checkpolicy-fuzzer']
require_class	93	46	49.46%	['checkpolicy-fuzzer']
define_class	51	22	43.13%	['checkpolicy-fuzzer']
define_permissive	33	17	51.51%	['checkpolicy-fuzzer']
define_neveraudit	33	15	45.45%	['checkpolicy-fuzzer']
define_common_perms	78	37	47.43%	['checkpolicy-fuzzer']
define_av_perms	96	36	37.5%	['checkpolicy-fuzzer']
define_sens	131	47	35.87%	['checkpolicy-fuzzer']
define_category	121	41	33.88%	['checkpolicy-fuzzer']
define_level	93	37	39.78%	['checkpolicy-fuzzer']
expand_attrib	65	17	26.15%	['checkpolicy-fuzzer']
define_typeattribute	59	27	45.76%	['checkpolicy-fuzzer']
define_bool_tunable	65	28	43.07%	['checkpolicy-fuzzer']
define_roleattribute	53	28	52.83%	['checkpolicy-fuzzer']
define_pirq_context	38	7	18.42%	['checkpolicy-fuzzer']
define_iomem_context	47	7	14.89%	['checkpolicy-fuzzer']
define_ioport_context	47	7	14.89%	['checkpolicy-fuzzer']
define_pcidevice_context	39	7	17.94%	['checkpolicy-fuzzer']
define_devicetree_context	43	8	18.60%	['checkpolicy-fuzzer']
define_port_context	76	35	46.05%	['checkpolicy-fuzzer']
define_netif_context	49	9	18.36%	['checkpolicy-fuzzer']
define_fs_use	42	8	19.04%	['checkpolicy-fuzzer']
define_range_trans	103	53	51.45%	['checkpolicy-fuzzer']
add_aliases_to_type	57	17	29.82%	['checkpolicy-fuzzer']
avrule_sort_xperms	40	20	50.0%	['checkpolicy-fuzzer']
define_genfs_context_helper	134	67	50.0%	['checkpolicy-fuzzer']
copy_and_expand_avrule_block	62	28	45.16%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
copy_role_trans	77	11	14.28%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
expand_filename_trans	42	10	23.80%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
expand_range_trans	41	10	24.39%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
cond_node_copy	46	5	10.86%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
class_copy_callback	71	31	43.66%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
class_copy_default_new_object	31	16	51.61%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
ocontext_copy_selinux	88	45	51.13%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
ocontext_copy_xen	62	30	48.38%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
cil_avrulex_to_hashtable	131	43	32.82%	['secilc-fuzzer']
__cil_contexts_to_policydb	56	25	44.64%	['secilc-fuzzer']
cil_check_neverallow	81	43	53.08%	['secilc-fuzzer']
__cil_verify_booleanif_helper	53	23	43.39%	['secilc-fuzzer']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/selinux/libselinux/src/check_context.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_verify.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_tree.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_log.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/assertion.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/usr/include/x86_64-linux-gnu/bits/uintn-identity.h	[]	[]
/src/selinux/libsepol/src/write.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/libselinux/src/regex.c	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
/src/selinux/libselinux/src/lsetfilecon.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_resolve_ast.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/fuzz/secilc-fuzzer.c	['secilc-fuzzer']	['secilc-fuzzer']
/src/selinux/libsepol/src/policydb_public.c	['secilc-fuzzer']	['secilc-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_parser.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_deny.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/kernel_to_cil.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/expand.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/libsepol/src/conditional.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/libsepol/src/avrule_block.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/checkpolicy/queue.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/debug.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/module_to_cil.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_find.c	['secilc-fuzzer']	[]
/src/selinux/checkpolicy/module_compiler.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/fuzz/binpolicy-fuzzer.c	['binpolicy-fuzzer']	['binpolicy-fuzzer']
/src/selinux/libsepol/src/kernel_to_conf.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/label_db.c	[]	[]
/src/selinux/libselinux/src/enabled.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_copy_ast.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/fuzz/selabel_file_compiled-fuzzer.c	['selabel_file_compiled-fuzzer']	['selabel_file_compiled-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_reset_ast.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_binary.c	['secilc-fuzzer']	[]
/src/selinux/checkpolicy/parse_util.c	[]	[]
/src/selinux/libsepol/src/module.c	[]	[]
/src/selinux/checkpolicy/fuzz/checkpolicy-fuzzer.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_write_ast.c	[]	[]
/src/selinux/libsepol/src/context_record.c	[]	[]
/src/selinux/libselinux/src/selinux_config.c	[]	[]
/src/selinux/libselinux/src/label_support.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/selinux_internal.c	[]	[]
/src/selinux/libselinux/fuzz/selabel_file_text-fuzzer.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_lexer.l	['secilc-fuzzer']	[]
/src/selinux/checkpolicy/policy_scan.l	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_post.c	['secilc-fuzzer']	[]
/src/selinux/DESTDIR/usr/include/sepol/policydb/mls_types.h	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/libsepol/src/sidtab.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/mls.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/libsepol/src/util.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_lexer.c	['secilc-fuzzer']	[]
/src/selinux/checkpolicy/lex.yy.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libselinux/src/init.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_build_ast.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/context.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/kernel_to_common.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/matchpathcon.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_list.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/policyvers.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_fqn.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_mem.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/label_file.c	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
/src/selinux/checkpolicy/y.tab.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/policydb_validate.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/setrans_client.c	[]	[]
/src/selinux/libsepol/src/constraint.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/libselinux/src/freecon.c	[]	[]
/src/selinux/DESTDIR/usr/include/sepol/policydb/context.h	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/libselinux/src/label_media.c	[]	[]
/usr/include/x86_64-linux-gnu/bits/byteswap.h	['selabel_file_compiled-fuzzer', 'checkpolicy-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_stack.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/hashtab.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/libselinux/src/canonicalize_context.c	[]	[]
/src/selinux/libsepol/src/symtab.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/libselinux/src/sha1.c	[]	[]
/src/selinux/libselinux/src/seusers.c	[]	[]
/src/selinux/libselinux/src/label_x.c	[]	[]
/src/selinux/libsepol/src/avtab.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/libsepol/src/ebitmap.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_strpool.c	['secilc-fuzzer']	[]
/src/selinux/DESTDIR/usr/include/sepol/policydb/ebitmap.h	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/libselinux/src/./selinux_internal.h	[]	[]
/src/selinux/libsepol/src/polcaps.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/libselinux/src/./label_file.h	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']	[]
/src/selinux/libsepol/src/link.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/policydb.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/libsepol/src/./private.h	['binpolicy-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_symtab.c	['secilc-fuzzer']	[]
/src/selinux/checkpolicy/policy_define.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_policy.c	[]	[]
/src/selinux/libselinux/src/label.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/libsepol/src/optimize.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/libselinux/src/callbacks.c	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
/src/selinux/libsepol/src/policydb_convert.c	[]	[]
/src/selinux/libsepol/src/hierarchy.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/libsepol/src/services.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer', 'secilc-fuzzer']
/src/selinux/libselinux/src/lgetfilecon.c	[]	[]

Directories in report

Directory
/src/selinux/libsepol/src/
/src/selinux/libsepol/fuzz/
/usr/include/x86_64-linux-gnu/bits/
/src/selinux/libselinux/src/
/src/selinux/checkpolicy/
/src/selinux/libselinux/fuzz/
/src/selinux/DESTDIR/usr/include/sepol/policydb/
/src/selinux/checkpolicy/fuzz/
/src/selinux/libselinux/src/./
/src/selinux/libsepol/src/./
/src/selinux/libsepol/src/../cil/src/