High level conclusions

Fuzzers reach 76.62% of cyclomatic complexity.

Fuzzers reach 73.56% of all functions.

Fuzzer secilc-fuzzer is blocked:

The runtime code coverage of secilc-fuzzer covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1837 / 2497

Cyclomatic complexity statically reachable by fuzzers

14644 / 19112

Runtime code coverage of functions

845 / 2497

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: selabel_file_compiled-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	103	28.1%
gold	[1:9]	7	1.91%
yellow	[10:29]	8	2.18%
greenyellow	[30:49]	18	4.91%
lawngreen	50+	230	62.8%
All colors	366	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	247	spec_node_cmp	call site: 00247	__errno_location
19	218	spec_node_cmp	call site: 00218	rspec_incomp
17	200	spec_node_cmp	call site: 00200	lspec_incomp
8	238	spec_node_cmp	call site: 00238	__errno_location
6	342	lookup_all	call site: 00342	all_node_specs
4	195	spec_node_cmp	call site: 00195	__errno_location
4	281	selabel_sub_key	call site: 00281	selabel_apply_subs
3	21	load_mmap	call site: 00021	__errno_location
3	319	regex_format_error	call site: 00319	abort
2	10	write_full	call site: 00010	close
2	115	regex_load_mmap	call site: 00115	regex_data_create
2	119	regex_data_create	call site: 00119	pcre2_serialize_decode_8

Runtime coverage analysis

Covered functions

46

Functions that are reachable but not covered

47

Reachable functions

86

Percentage of reachable functions covered

45.35%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libselinux/fuzz/selabel_file_compiled-fuzzer.c	3
libselinux/src/callbacks.c	1
libselinux/src/label_file.c	25
libselinux/src/./label_file.h	5
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
libselinux/src/regex.c	9
libselinux/fuzz/../src/label_file.h	1

Fuzzer: selabel_file_text-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	119	39.9%
gold	[1:9]	7	2.34%
yellow	[10:29]	11	3.69%
greenyellow	[30:49]	3	1.00%
lawngreen	50+	158	53.0%
All colors	298	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	199	spec_node_cmp	call site: 00199	__errno_location
19	170	spec_node_cmp	call site: 00170	rspec_incomp
17	152	spec_node_cmp	call site: 00152	lspec_incomp
8	190	spec_node_cmp	call site: 00190	__errno_location
6	103	selabel_validate	call site: 00103	__errno_location
4	111	insert_spec	call site: 00111	__errno_location
4	147	spec_node_cmp	call site: 00147	__errno_location
4	233	selabel_sub_key	call site: 00233	selabel_apply_subs
3	32	process_line	call site: 00032	__errno_location
3	82	regex_format_error	call site: 00082	abort
3	96	insert_spec	call site: 00096	pthread_mutex_lock
3	255	lookup_check_node	call site: 00255	__errno_location

Runtime coverage analysis

Covered functions

44

Functions that are reachable but not covered

37

Reachable functions

66

Percentage of reachable functions covered

43.94%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libselinux/fuzz/selabel_file_text-fuzzer.c	3
libselinux/src/callbacks.c	1
libselinux/src/label_file.c	18
libselinux/src/./label_file.h	9
libselinux/src/label_support.c	2
libselinux/src/regex.c	5
libselinux/src/matchpathcon.c	1
libselinux/src/label.c	1
libselinux/fuzz/../src/label_file.h	1

Fuzzer: secilc-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	4984	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	4984	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
4983	0	EP	call site: 00000	cil_compile

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

1155

Reachable functions

1155

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libsepol/fuzz/secilc-fuzzer.c	2
libsepol/src/../cil/src/cil_log.c	5
libsepol/src/../cil/src/cil.c	111
libsepol/src/../cil/src/cil_mem.c	5
libsepol/src/../cil/src/cil_strpool.c	6
libsepol/src/hashtab.c	7
libsepol/src/../cil/src/cil_tree.c	13
libsepol/src/../cil/src/cil_symtab.c	13
libsepol/src/symtab.c	3
libsepol/src/../cil/src/cil_list.c	11
libsepol/src/../cil/src/cil_parser.c	7
libsepol/src/../cil/src/cil_stack.c	7
libsepol/src/../cil/src/cil_lexer.l	3
libsepol/src/../cil/src/cil_lexer.c	20
libsepol/src/../cil/src/cil_build_ast.c	202
libsepol/src/../cil/src/cil_verify.c	55
libsepol/src/ebitmap.c	16
libsepol/src/../cil/src/cil_copy_ast.c	4
libsepol/src/../cil/src/cil_resolve_ast.c	97
libsepol/src/../cil/src/cil_reset_ast.c	57
libsepol/src/../cil/src/cil_fqn.c	3
libsepol/src/../cil/src/cil_post.c	75
DESTDIR/usr/include/sepol/policydb/ebitmap.h	4
libsepol/src/../cil/src/cil_deny.c	41
libsepol/src/../cil/src/cil_find.c	16
libsepol/src/polcaps.c	1
libsepol/src/../cil/src/cil_binary.c	138
libsepol/src/policydb_public.c	7
libsepol/src/policydb.c	43
libsepol/src/avrule_block.c	6
libsepol/src/conditional.c	16
libsepol/src/mls.c	5
libsepol/src/avtab.c	11
libsepol/src/util.c	1
DESTDIR/usr/include/sepol/policydb/mls_types.h	8
libsepol/src/constraint.c	2
DESTDIR/usr/include/sepol/policydb/context.h	3
libsepol/src/assertion.c	10
libsepol/src/hierarchy.c	19
libsepol/src/expand.c	11
libsepol/src/optimize.c	16
libsepol/src/write.c	39
libsepol/src/services.c	1

Fuzzer: binpolicy-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1013	33.3%
gold	[1:9]	123	4.05%
yellow	[10:29]	62	2.04%
greenyellow	[30:49]	114	3.75%
lawngreen	50+	1723	56.7%
All colors	3035	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
187	2745	user_datum_destroy	call site: 02745	copy_and_expand_avrule_block
127	2612	expand_attributes_in_attributes	call site: 02612	user_copy_callback
124	2395	prepare_base	call site: 02395	copy_module
61	833	check_assertion	call site: 00833	check_assertion_extended_permissions
44	2955	constraint_expr_destroy	call site: 02955	sepol_kernel_policydb_to_conf
26	896	check_assertion	call site: 00896	report_assertion_failures
22	1123	cond_write_node	call site: 01123	expand_cond_av_list
19	2934	constraint_expr_init	call site: 02934	expand_convert_type_set
17	930	sepol_extended_perms_to_string	call site: 00930	sepol_extended_perms_to_string
17	2594	expand_attributes_in_attributes	call site: 02594	ebitmap_union
15	1085	expand_avtab_insert	call site: 01085	expand_avtab_insert
13	2529	is_decl_requires_met	call site: 02529	is_perm_existent

Runtime coverage analysis

Covered functions

554

Functions that are reachable but not covered

148

Reachable functions

660

Percentage of reachable functions covered

77.58%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libsepol/fuzz/binpolicy-fuzzer.c	2
libsepol/src/debug.c	1
libsepol/src/policydb.c	87
libsepol/src/symtab.c	4
libsepol/src/hashtab.c	6
libsepol/src/avrule_block.c	8
libsepol/src/conditional.c	25
libsepol/src/ebitmap.c	13
libsepol/src/mls.c	7
DESTDIR/usr/include/sepol/policydb/ebitmap.h	4
libsepol/src/avtab.c	14
libsepol/src/util.c	4
libsepol/src/services.c	3
libsepol/src/./private.h	1
libsepol/src/policydb_validate.c	71
libsepol/src/expand.c	63
DESTDIR/usr/include/sepol/policydb/mls_types.h	9
libsepol/src/context.c	2
DESTDIR/usr/include/sepol/policydb/context.h	5
libsepol/src/polcaps.c	1
libsepol/src/sidtab.c	3
libsepol/src/optimize.c	16
libsepol/src/assertion.c	17
libsepol/src/hierarchy.c	27
libsepol/src/write.c	39
libsepol/src/kernel_to_conf.c	75
libsepol/src/kernel_to_common.c	43
libsepol/src/kernel_to_cil.c	76
libsepol/src/link.c	32
libsepol/src/constraint.c	2

Fuzzer: checkpolicy-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2251	47.0%
gold	[1:9]	152	3.17%
yellow	[10:29]	113	2.36%
greenyellow	[30:49]	41	0.85%
lawngreen	50+	2228	46.5%
All colors	4785	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
332	4415	sepol_kernel_policydb_to_cil	call site: 04415	sepol_module_policydb_to_cil
129	2674	sepol_av_to_string	call site: 02674	check_assertions
123	2003	prepare_base	call site: 02003	copy_module
80	2433	copy_and_expand_avrule_block	call site: 02433	convert_and_expand_rule
63	3270	filename_trans_write	call site: 03270	avrule_block_write
52	2616	bounds_check_types	call site: 02616	bounds_check_type
50	1831	define_genfs_context_helper	call site: 01831	define_genfs_context
37	3201	cond_write_list	call site: 03201	cond_write_node
35	1386	insert_separator	call site: 01386	define_user
31	3734	sepol_kernel_policydb_to_conf	call site: 03734	write_cond_av_list_to_conf
22	4220	write_cond_nodes_to_cil	call site: 04220	write_cond_av_list_to_cil
21	631	expand_attrib	call site: 00631	define_type

Runtime coverage analysis

Covered functions

643

Functions that are reachable but not covered

287

Reachable functions

892

Percentage of reachable functions covered

67.83%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
checkpolicy/fuzz/checkpolicy-fuzzer.c	4
libsepol/src/debug.c	1
libsepol/src/policydb.c	61
libsepol/src/symtab.c	4
libsepol/src/hashtab.c	6
libsepol/src/avrule_block.c	9
libsepol/src/conditional.c	22
libsepol/src/ebitmap.c	12
libsepol/src/mls.c	8
DESTDIR/usr/include/sepol/policydb/ebitmap.h	4
libsepol/src/avtab.c	11
libsepol/src/util.c	4
checkpolicy/queue.c	7
checkpolicy/lex.yy.c	18
checkpolicy/policy_define.c	105
checkpolicy/policy_scan.l	5
checkpolicy/y.tab.c	2
checkpolicy/module_compiler.c	40
libsepol/src/policydb_validate.c	71
libsepol/src/expand.c	63
DESTDIR/usr/include/sepol/policydb/mls_types.h	9
DESTDIR/usr/include/sepol/policydb/context.h	6
libsepol/src/constraint.c	2
libsepol/src/context.c	2
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
libsepol/src/polcaps.c	2
libsepol/src/link.c	32
libsepol/src/hierarchy.c	27
libsepol/src/assertion.c	17
libsepol/src/sidtab.c	3
libsepol/src/optimize.c	16
libsepol/src/kernel_to_common.c	43
libsepol/src/write.c	39
libsepol/src/services.c	1
libsepol/src/kernel_to_conf.c	75
libsepol/src/kernel_to_cil.c	76
libsepol/src/module_to_cil.c	71

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
cil_write_policy_conf	/src/selinux/libsepol/src/../cil/src/cil.c	2	['N/A', 'N/A']	16	0	19	3	2	203	0	898	377
cil_write_post_ast	/src/selinux/libsepol/src/../cil/src/cil.c	2	['N/A', 'N/A']	19	0	122	16	8	774	0	4815	290
selabel_file_init	/src/selinux/libselinux/src/label_file.c	3	['N/A', 'N/A', 'int']	6	0	84	8	4	35	0	309	252
selinux_file_context_verify	/src/selinux/libselinux/src/matchpathcon.c	2	['N/A', 'int']	8	0	155	28	11	52	0	252	220
sepol_get_user_sids	/src/selinux/libsepol/src/services.c	4	['int', 'N/A', 'N/A', 'N/A']	8	0	336	46	18	50	0	362	211
sepol_check_context	/src/selinux/libsepol/src/context.c	1	['N/A']	9	0	18	3	2	53	0	328	153
sepol_ppfile_to_module_package	/src/selinux/libsepol/src/module_to_cil.c	2	['N/A', 'N/A']	11	0	251	38	13	261	0	2168	143

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

2021 / 2497

Cyclomatic complexity statically reachable by fuzzers

16256 / 19112

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

libselinux/fuzz/selabel_file_compiled-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['spec_node_cmp', 'lookup_all', 'selabel_sub_key', 'load_mmap', 'regex_format_error', 'write_full']

libselinux/fuzz/selabel_file_text-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['spec_node_cmp', 'selabel_validate', 'insert_spec', 'selabel_sub_key', 'process_line', 'regex_format_error']

libsepol/fuzz/secilc-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

libsepol/fuzz/binpolicy-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['user_datum_destroy', 'expand_attributes_in_attributes', 'prepare_base', 'check_assertion', 'constraint_expr_destroy', 'cond_write_node', 'constraint_expr_init', 'sepol_extended_perms_to_string']

checkpolicy/fuzz/checkpolicy-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sepol_kernel_policydb_to_cil', 'sepol_av_to_string', 'prepare_base', 'copy_and_expand_avrule_block', 'filename_trans_write', 'bounds_check_types', 'define_genfs_context_helper', 'cond_write_list', 'insert_separator', 'sepol_kernel_policydb_to_conf']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
init_selinuxmnt	38	14	36.84%	['selabel_file_text-fuzzer', 'selabel_file_compiled-fuzzer']
spec_node_cmp	288	71	24.65%	['selabel_file_text-fuzzer', 'selabel_file_compiled-fuzzer']
regex_load_mmap	38	15	39.47%	['selabel_file_compiled-fuzzer']
regex_format_error	54	27	50.0%	['selabel_file_text-fuzzer', 'selabel_file_compiled-fuzzer']
compat_validate	41	10	24.39%	['selabel_file_text-fuzzer']
discard_tunables	67	18	26.86%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
expand_attributes_in_attributes	50	26	52.0%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
expand_avtab_node	49	18	36.73%	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
expand_avtab_insert	53	16	30.18%	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
write_type_neveraudit_rules_to_cil	33	17	51.51%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_selinux_port_rules_to_cil	56	15	26.78%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_xen_ioport_rules_to_cil	37	15	40.54%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_xen_iomem_rules_to_cil	37	14	37.83%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_type_neveraudit_rules_to_conf	33	17	51.51%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_selinux_port_rules_to_conf	56	15	26.78%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_xen_iomem_rules_to_conf	35	13	37.14%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
write_xen_ioport_rules_to_conf	35	14	40.0%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
link_modules	82	28	34.14%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
print_missing_requirements	32	16	50.0%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
avrule_write	83	25	30.12%	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
filename_trans_rule_write	42	12	28.57%	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
ocontext_write_selinux	127	69	54.33%	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
ocontext_write_xen	109	42	38.53%	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
yy_get_next_buffer	89	47	52.80%	['secilc-fuzzer', 'checkpolicy-fuzzer']
define_policy	41	15	36.58%	['checkpolicy-fuzzer']
require_class	92	45	48.91%	['checkpolicy-fuzzer']
define_class	51	22	43.13%	['checkpolicy-fuzzer']
define_permissive	33	17	51.51%	['checkpolicy-fuzzer']
define_neveraudit	33	15	45.45%	['checkpolicy-fuzzer']
define_default_range	33	8	24.24%	['checkpolicy-fuzzer']
define_common_perms	79	37	46.83%	['checkpolicy-fuzzer']
define_av_perms	94	43	45.74%	['checkpolicy-fuzzer']
define_sens	134	50	37.31%	['checkpolicy-fuzzer']
define_category	120	39	32.5%	['checkpolicy-fuzzer']
define_level	87	35	40.22%	['checkpolicy-fuzzer']
expand_attrib	66	17	25.75%	['checkpolicy-fuzzer']
define_typeattribute	63	29	46.03%	['checkpolicy-fuzzer']
define_bool_tunable	65	28	43.07%	['checkpolicy-fuzzer']
define_roleattribute	53	28	52.83%	['checkpolicy-fuzzer']
define_pirq_context	38	7	18.42%	['checkpolicy-fuzzer']
define_iomem_context	50	7	14.00%	['checkpolicy-fuzzer']
define_ioport_context	48	7	14.58%	['checkpolicy-fuzzer']
define_pcidevice_context	39	7	17.94%	['checkpolicy-fuzzer']
define_devicetree_context	44	8	18.18%	['checkpolicy-fuzzer']
define_port_context	77	38	49.35%	['checkpolicy-fuzzer']
define_netif_context	49	9	18.36%	['checkpolicy-fuzzer']
define_fs_use	43	8	18.60%	['checkpolicy-fuzzer']
define_range_trans	105	53	50.47%	['checkpolicy-fuzzer']
add_aliases_to_type	59	18	30.50%	['checkpolicy-fuzzer']
avrule_sort_xperms	40	20	50.0%	['checkpolicy-fuzzer']
define_genfs_context_helper	135	68	50.37%	['checkpolicy-fuzzer']
copy_and_expand_avrule_block	66	28	42.42%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
copy_role_trans	93	11	11.82%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
expand_filename_trans	40	10	25.0%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
expand_range_trans	40	10	25.0%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
cond_node_copy	46	5	10.86%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
class_copy_callback	68	29	42.64%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
class_copy_default_new_object	39	16	41.02%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
ocontext_copy_selinux	91	47	51.64%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
ocontext_copy_xen	62	30	48.38%	['checkpolicy-fuzzer', 'binpolicy-fuzzer']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/selinux/libselinux/src/label_x.c	[]	[]
/src/selinux/libsepol/src/conditional.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/avtab.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/label_media.c	[]	[]
/src/selinux/libsepol/src/context_record.c	[]	[]
/src/selinux/libsepol/src/policydb_convert.c	[]	[]
/src/selinux/libselinux/src/setrans_client.c	[]	[]
/src/selinux/libsepol/src/optimize.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/label_support.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/libsepol/src/symtab.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/policydb_public.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/assertion.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/freecon.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_parser.c	['secilc-fuzzer']	[]
/usr/include/x86_64-linux-gnu/bits/uintn-identity.h	[]	[]
/src/selinux/checkpolicy/policy_define.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/fuzz/binpolicy-fuzzer.c	['binpolicy-fuzzer']	['binpolicy-fuzzer']
/src/selinux/libselinux/src/canonicalize_context.c	[]	[]
/src/selinux/libselinux/src/regex.c	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
/src/selinux/libselinux/src/policyvers.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_reset_ast.c	['secilc-fuzzer']	[]
/src/selinux/DESTDIR/usr/include/sepol/policydb/context.h	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/label_file.c	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_build_ast.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_lexer.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/fuzz/secilc-fuzzer.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/lsetfilecon.c	[]	[]
/src/selinux/libselinux/src/seusers.c	[]	[]
/src/selinux/libselinux/src/sha1.c	[]	[]
/src/selinux/libsepol/src/util.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/services.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_copy_ast.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/hashtab.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_binary.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/./label_file.h	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']	[]
/src/selinux/libsepol/src/write.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_symtab.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/matchpathcon.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/libsepol/src/link.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/callbacks.c	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_find.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/module_to_cil.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libselinux/src/label_db.c	[]	[]
/src/selinux/libselinux/src/init.c	[]	[]
/src/selinux/libsepol/src/kernel_to_cil.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/lgetfilecon.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_verify.c	['secilc-fuzzer']	[]
/src/selinux/checkpolicy/y.tab.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/context.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/checkpolicy/parse_util.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_resolve_ast.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/hierarchy.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_mem.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/mls.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_tree.c	['secilc-fuzzer']	[]
/src/selinux/checkpolicy/policy_scan.l	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_fqn.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_log.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/kernel_to_common.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/debug.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/usr/include/x86_64-linux-gnu/bits/byteswap.h	['selabel_file_compiled-fuzzer', 'checkpolicy-fuzzer']	[]
/src/selinux/libsepol/src/constraint.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/DESTDIR/usr/include/sepol/policydb/mls_types.h	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_lexer.l	['secilc-fuzzer']	[]
/src/selinux/libselinux/fuzz/selabel_file_compiled-fuzzer.c	['selabel_file_compiled-fuzzer']	['selabel_file_compiled-fuzzer']
/src/selinux/libsepol/src/./private.h	['binpolicy-fuzzer']	[]
/src/selinux/libsepol/src/module.c	[]	[]
/src/selinux/libselinux/fuzz/selabel_file_text-fuzzer.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/libsepol/src/avrule_block.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/check_context.c	[]	[]
/src/selinux/checkpolicy/fuzz/checkpolicy-fuzzer.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/expand.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/sidtab.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_list.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_strpool.c	['secilc-fuzzer']	[]
/src/selinux/checkpolicy/lex.yy.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/polcaps.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/checkpolicy/module_compiler.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/kernel_to_conf.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/label.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_deny.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/enabled.c	[]	[]
/src/selinux/libsepol/src/policydb_validate.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_write_ast.c	[]	[]
/src/selinux/libsepol/src/policydb.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/selinux_internal.c	[]	[]
/src/selinux/libselinux/src/./selinux_internal.h	[]	[]
/src/selinux/checkpolicy/queue.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_stack.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/ebitmap.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/selinux_config.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_post.c	['secilc-fuzzer']	[]
/src/selinux/DESTDIR/usr/include/sepol/policydb/ebitmap.h	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_policy.c	[]	[]

Directories in report

Directory
/src/selinux/libsepol/fuzz/
/src/selinux/DESTDIR/usr/include/sepol/policydb/
/usr/include/x86_64-linux-gnu/bits/
/src/selinux/checkpolicy/
/src/selinux/libselinux/src/./
/src/selinux/checkpolicy/fuzz/
/src/selinux/libsepol/src/../cil/src/
/src/selinux/libselinux/src/
/src/selinux/libsepol/src/
/src/selinux/libsepol/src/./
/src/selinux/libselinux/fuzz/