High level conclusions

Fuzzers reach 77.69% of cyclomatic complexity.

Fuzzers reach 74.44% of all functions.

Fuzzer secilc-fuzzer is blocked:

The runtime code coverage of secilc-fuzzer covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Reachability and coverage overview

Functions statically reachable by fuzzers

1864 / 2504

Cyclomatic complexity statically reachable by fuzzers

14818 / 19072

Runtime code coverage of functions

951 / 2504

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: selabel_file_compiled-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	98	26.2%
gold	[1:9]	15	4.02%
yellow	[10:29]	4	1.07%
greenyellow	[30:49]	6	1.60%
lawngreen	50+	250	67.0%
All colors	373	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	244	spec_node_cmp	call site: 00244	__errno_location
19	215	spec_node_cmp	call site: 00215	rspec_incomp
17	197	spec_node_cmp	call site: 00197	lspec_incomp
8	235	spec_node_cmp	call site: 00235	__errno_location
4	192	spec_node_cmp	call site: 00192	__errno_location
4	278	selabel_sub_key	call site: 00278	selabel_apply_subs
3	21	load_mmap	call site: 00021	__errno_location
3	316	regex_format_error	call site: 00316	abort
2	10	write_full	call site: 00010	close
2	118	regex_data_create	call site: 00118	pcre2_serialize_decode_8
2	307	compile_regex	call site: 00307	pthread_mutex_unlock
1	13	convert_data	call site: 00013	close

Runtime coverage analysis

Covered functions

47

Functions that are reachable but not covered

54

Reachable functions

95

Percentage of reachable functions covered

43.16%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libselinux/fuzz/selabel_file_compiled-fuzzer.c	3
libselinux/src/callbacks.c	1
libselinux/src/label_file.c	25
libselinux/src/./label_file.h	5
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
libselinux/src/regex.c	11
libselinux/fuzz/../src/label_file.h	1

Fuzzer: selabel_file_text-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	119	39.0%
gold	[1:9]	7	2.29%
yellow	[10:29]	4	1.31%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	175	57.3%
All colors	305	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	196	spec_node_cmp	call site: 00196	__errno_location
19	167	spec_node_cmp	call site: 00167	rspec_incomp
17	149	spec_node_cmp	call site: 00149	lspec_incomp
8	187	spec_node_cmp	call site: 00187	__errno_location
6	100	selabel_validate	call site: 00100	__errno_location
4	108	insert_spec	call site: 00108	__errno_location
4	144	spec_node_cmp	call site: 00144	__errno_location
4	230	selabel_sub_key	call site: 00230	selabel_apply_subs
3	32	process_line	call site: 00032	__errno_location
3	79	regex_format_error	call site: 00079	abort
3	93	insert_spec	call site: 00093	pthread_mutex_lock
3	252	lookup_check_node	call site: 00252	__errno_location

Runtime coverage analysis

Covered functions

44

Functions that are reachable but not covered

45

Reachable functions

75

Percentage of reachable functions covered

40.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libselinux/fuzz/selabel_file_text-fuzzer.c	3
libselinux/src/callbacks.c	1
libselinux/src/label_file.c	18
libselinux/src/./label_file.h	9
libselinux/src/label_support.c	2
libselinux/src/regex.c	7
libselinux/src/matchpathcon.c	1
libselinux/src/label.c	1
libselinux/fuzz/../src/label_file.h	1

Fuzzer: secilc-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	5008	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	5008	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
5007	0	EP	call site: 00000	cil_compile

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

1159

Reachable functions

1159

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libsepol/fuzz/secilc-fuzzer.c	2
libsepol/src/../cil/src/cil_log.c	5
libsepol/src/../cil/src/cil.c	111
libsepol/src/../cil/src/cil_mem.c	6
libsepol/src/../cil/src/cil_strpool.c	6
libsepol/src/hashtab.c	7
libsepol/src/../cil/src/cil_tree.c	14
libsepol/src/../cil/src/cil_symtab.c	13
libsepol/src/symtab.c	3
libsepol/src/../cil/src/cil_list.c	11
libsepol/src/../cil/src/cil_parser.c	7
libsepol/src/../cil/src/cil_stack.c	7
libsepol/src/../cil/src/cil_lexer.l	3
libsepol/src/../cil/src/cil_lexer.c	20
libsepol/src/../cil/src/cil_build_ast.c	202
libsepol/src/../cil/src/cil_verify.c	55
libsepol/src/ebitmap.c	16
libsepol/src/../cil/src/cil_copy_ast.c	4
libsepol/src/../cil/src/cil_resolve_ast.c	97
libsepol/src/../cil/src/cil_reset_ast.c	57
libsepol/src/../cil/src/cil_fqn.c	3
libsepol/src/../cil/src/cil_post.c	75
DESTDIR/usr/include/sepol/policydb/ebitmap.h	4
libsepol/src/../cil/src/cil_deny.c	41
libsepol/src/../cil/src/cil_find.c	16
libsepol/src/polcaps.c	1
libsepol/src/../cil/src/cil_binary.c	138
libsepol/src/policydb_public.c	7
libsepol/src/policydb.c	43
libsepol/src/avrule_block.c	6
libsepol/src/conditional.c	16
libsepol/src/mls.c	5
libsepol/src/avtab.c	11
libsepol/src/util.c	4
DESTDIR/usr/include/sepol/policydb/mls_types.h	8
libsepol/src/constraint.c	2
DESTDIR/usr/include/sepol/policydb/context.h	3
libsepol/src/assertion.c	16
libsepol/src/hierarchy.c	19
libsepol/src/expand.c	5
libsepol/src/optimize.c	17
libsepol/src/write.c	37
libsepol/src/services.c	1

Fuzzer: module-package-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	394	30.9%
gold	[1:9]	44	3.45%
yellow	[10:29]	37	2.90%
greenyellow	[30:49]	5	0.39%
lawngreen	50+	795	62.3%
All colors	1275	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
36	224	cond_read_node	call site: 00224	filename_trans_read
34	554	genfs_read	call site: 00554	range_read
23	886	cil_printf	call site: 00886	linked_blocks_to_cil
23	1083	block_to_cil	call site: 01083	avrule_list_to_cil
21	1050	block_to_cil	call site: 01050	process_typeset
19	158	policydb_read	call site: 00158	cond_read_list
17	519	ocontext_read_selinux	call site: 00519	ocontext_read_xen
17	637	validate_avrules	call site: 00637	validate_filename_trans_hashtab
15	184	cond_read_node	call site: 00184	cond_read_av_list
12	421	role_set_expand	call site: 00421	map_ebitmap
9	614	validate_value	call site: 00614	validate_cond_list
9	876	genfscon_to_cil	call site: 00876	cil_printf

Runtime coverage analysis

Covered functions

343

Functions that are reachable but not covered

81

Reachable functions

364

Percentage of reachable functions covered

77.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libsepol/fuzz/module-package-fuzzer.c	1
libsepol/src/debug.c	1
libsepol/src/policydb_public.c	5
libsepol/src/module.c	16
libsepol/src/policydb.c	77
libsepol/src/symtab.c	3
libsepol/src/hashtab.c	6
libsepol/src/avrule_block.c	6
libsepol/src/conditional.c	12
libsepol/src/ebitmap.c	13
libsepol/src/mls.c	7
DESTDIR/usr/include/sepol/policydb/ebitmap.h	4
libsepol/src/avtab.c	14
libsepol/src/util.c	5
libsepol/src/services.c	2
libsepol/src/./private.h	1
libsepol/src/policydb_validate.c	72
libsepol/src/expand.c	5
DESTDIR/usr/include/sepol/policydb/mls_types.h	5
libsepol/src/context.c	2
DESTDIR/usr/include/sepol/policydb/context.h	3
libsepol/src/polcaps.c	1
libsepol/src/module_to_cil.c	80

Fuzzer: binpolicy-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1243	37.4%
gold	[1:9]	101	3.04%
yellow	[10:29]	64	1.93%
greenyellow	[30:49]	76	2.29%
lawngreen	50+	1831	55.2%
All colors	3315	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
187	3024	user_datum_destroy	call site: 03024	copy_and_expand_avrule_block
124	2678	prepare_base	call site: 02678	copy_module
122	2896	expand_attributes_in_attributes	call site: 02896	user_copy_callback
54	857	ebitmap_and	call site: 00857	check_assertion_extended_permissions
45	3234	constraint_expr_destroy	call site: 03234	sepol_kernel_policydb_to_conf
25	913	check_assertion	call site: 00913	report_assertion_failures
23	2390	cil_printf	call site: 02390	linked_blocks_to_cil
23	2581	block_to_cil	call site: 02581	avrule_list_to_cil
22	2811	is_decl_requires_met	call site: 02811	debug_requirements
21	2548	block_to_cil	call site: 02548	process_typeset
19	3213	constraint_expr_init	call site: 03213	expand_convert_type_set
17	946	sepol_extended_perms_to_string	call site: 00946	sepol_extended_perms_to_string

Runtime coverage analysis

Covered functions

607

Functions that are reachable but not covered

179

Reachable functions

728

Percentage of reachable functions covered

75.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libsepol/fuzz/binpolicy-fuzzer.c	2
libsepol/src/debug.c	1
libsepol/src/policydb.c	87
libsepol/src/symtab.c	4
libsepol/src/hashtab.c	6
libsepol/src/avrule_block.c	8
libsepol/src/conditional.c	25
libsepol/src/ebitmap.c	13
libsepol/src/mls.c	7
DESTDIR/usr/include/sepol/policydb/ebitmap.h	4
libsepol/src/avtab.c	14
libsepol/src/util.c	4
libsepol/src/services.c	3
libsepol/src/./private.h	1
libsepol/src/policydb_validate.c	72
libsepol/src/expand.c	57
DESTDIR/usr/include/sepol/policydb/mls_types.h	9
libsepol/src/context.c	2
DESTDIR/usr/include/sepol/policydb/context.h	5
libsepol/src/polcaps.c	1
libsepol/src/sidtab.c	3
libsepol/src/optimize.c	17
libsepol/src/assertion.c	17
libsepol/src/hierarchy.c	27
libsepol/src/write.c	37
libsepol/src/kernel_to_conf.c	75
libsepol/src/kernel_to_common.c	43
libsepol/src/kernel_to_cil.c	76
libsepol/src/module_to_cil.c	71
libsepol/src/link.c	32
libsepol/src/constraint.c	2

Fuzzer: checkpolicy-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2069	43.7%
gold	[1:9]	256	5.41%
yellow	[10:29]	86	1.81%
greenyellow	[30:49]	13	0.27%
lawngreen	50+	2305	48.7%
All colors	4729	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
332	4359	sepol_kernel_policydb_to_cil	call site: 04359	sepol_module_policydb_to_cil
123	2002	prepare_base	call site: 02002	copy_module
63	3215	filename_trans_write	call site: 03215	avrule_block_write
61	2735	check_assertion	call site: 02735	report_assertion_failures
52	2609	bounds_check_types	call site: 02609	bounds_check_type
50	1834	define_genfs_context_helper	call site: 01834	define_genfs_context
43	2690	check_assertion_notself_match	call site: 02690	check_assertion_extended_permissions
35	1389	insert_separator	call site: 01389	define_user
31	3680	sepol_kernel_policydb_to_conf	call site: 03680	write_cond_av_list_to_conf
27	2428	copy_and_expand_avrule_block	call site: 02428	exp_rangetr_helper
22	4168	write_cond_nodes_to_cil	call site: 04168	write_cond_av_list_to_cil
21	2987	validate_mls_semantic_range	call site: 02987	validate_datum_array_entries

Runtime coverage analysis

Covered functions

661

Functions that are reachable but not covered

264

Reachable functions

887

Percentage of reachable functions covered

70.24%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
checkpolicy/fuzz/checkpolicy-fuzzer.c	4
libsepol/src/debug.c	1
libsepol/src/policydb.c	61
libsepol/src/symtab.c	4
libsepol/src/hashtab.c	6
libsepol/src/avrule_block.c	9
libsepol/src/conditional.c	22
libsepol/src/ebitmap.c	12
libsepol/src/mls.c	8
DESTDIR/usr/include/sepol/policydb/ebitmap.h	4
libsepol/src/avtab.c	11
libsepol/src/util.c	4
checkpolicy/queue.c	7
checkpolicy/lex.yy.c	18
checkpolicy/policy_define.c	106
checkpolicy/policy_scan.l	5
checkpolicy/y.tab.c	2
checkpolicy/module_compiler.c	40
libsepol/src/policydb_validate.c	72
libsepol/src/expand.c	57
DESTDIR/usr/include/sepol/policydb/mls_types.h	9
DESTDIR/usr/include/sepol/policydb/context.h	6
libsepol/src/constraint.c	2
libsepol/src/context.c	2
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
libsepol/src/polcaps.c	2
libsepol/src/link.c	32
libsepol/src/hierarchy.c	27
libsepol/src/assertion.c	17
libsepol/src/sidtab.c	3
libsepol/src/optimize.c	17
libsepol/src/kernel_to_common.c	43
libsepol/src/write.c	37
libsepol/src/services.c	1
libsepol/src/kernel_to_conf.c	75
libsepol/src/kernel_to_cil.c	76
libsepol/src/module_to_cil.c	71

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
cil_write_policy_conf	/src/selinux/libsepol/src/../cil/src/cil.c	2	['N/A', 'N/A']	16	0	19	3	2	204	0	902	377
cil_write_post_ast	/src/selinux/libsepol/src/../cil/src/cil.c	2	['N/A', 'N/A']	19	0	122	16	8	776	0	4827	290
selabel_file_init	/src/selinux/libselinux/src/label_file.c	3	['N/A', 'N/A', 'int']	6	0	84	8	4	35	0	311	254
selinux_file_context_verify	/src/selinux/libselinux/src/matchpathcon.c	2	['N/A', 'int']	8	0	155	28	11	53	0	258	222
sepol_get_user_sids	/src/selinux/libsepol/src/services.c	4	['int', 'N/A', 'N/A', 'N/A']	8	0	336	46	18	50	0	362	211
sepol_check_context	/src/selinux/libsepol/src/context.c	1	['N/A']	9	0	18	3	2	53	0	328	153
insert_spec	/src/selinux/libselinux/src/./label_file.h	9	['N/A', 'N/A', 'N/A', 'N/A', 'char', 'N/A', 'N/A', 'char', 'int']	4	0	1463	196	64	26	0	209	110

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

2041 / 2504

Cyclomatic complexity statically reachable by fuzzers

16407 / 19072

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

libselinux/fuzz/selabel_file_compiled-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['spec_node_cmp', 'selabel_sub_key', 'load_mmap', 'regex_format_error', 'write_full', 'regex_data_create']

libselinux/fuzz/selabel_file_text-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['spec_node_cmp', 'selabel_validate', 'insert_spec', 'selabel_sub_key', 'process_line', 'regex_format_error']

libsepol/fuzz/secilc-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

libsepol/fuzz/module-package-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['cond_read_node', 'genfs_read', 'cil_printf', 'block_to_cil', 'policydb_read', 'ocontext_read_selinux', 'validate_avrules', 'role_set_expand']

libsepol/fuzz/binpolicy-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['user_datum_destroy', 'prepare_base', 'expand_attributes_in_attributes', 'ebitmap_and', 'constraint_expr_destroy', 'check_assertion', 'cil_printf', 'block_to_cil', 'is_decl_requires_met']

checkpolicy/fuzz/checkpolicy-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sepol_kernel_policydb_to_cil', 'prepare_base', 'filename_trans_write', 'check_assertion', 'bounds_check_types', 'define_genfs_context_helper', 'check_assertion_notself_match', 'insert_separator', 'sepol_kernel_policydb_to_conf', 'copy_and_expand_avrule_block']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
spec_node_cmp	288	71	24.65%	['selabel_file_text-fuzzer', 'selabel_file_compiled-fuzzer']
regex_load_mmap	35	18	51.42%	['selabel_file_compiled-fuzzer']
regex_format_error	56	29	51.78%	['selabel_file_text-fuzzer', 'selabel_file_compiled-fuzzer']
compat_validate	41	10	24.39%	['selabel_file_text-fuzzer']
ocontext_isid_to_cil	60	13	21.66%	['binpolicy-fuzzer', 'module-package-fuzzer']
ocontext_selinux_port_to_cil	40	9	22.5%	['binpolicy-fuzzer', 'module-package-fuzzer']
ocontext_selinux_ibpkey_to_cil	31	10	32.25%	['binpolicy-fuzzer', 'module-package-fuzzer']
genfscon_to_cil	61	13	21.31%	['binpolicy-fuzzer', 'module-package-fuzzer', 'checkpolicy-fuzzer']
typealiases_to_cil	39	13	33.33%	['binpolicy-fuzzer', 'module-package-fuzzer', 'checkpolicy-fuzzer']
class_to_cil	126	33	26.19%	['binpolicy-fuzzer', 'module-package-fuzzer']
user_to_cil	38	13	34.21%	['binpolicy-fuzzer', 'module-package-fuzzer']
range_trans_to_cil	59	22	37.28%	['binpolicy-fuzzer', 'module-package-fuzzer', 'checkpolicy-fuzzer']
filename_trans_to_cil	54	17	31.48%	['binpolicy-fuzzer', 'module-package-fuzzer', 'checkpolicy-fuzzer']
cond_list_to_cil	33	7	21.21%	['binpolicy-fuzzer', 'module-package-fuzzer', 'checkpolicy-fuzzer']
validate_filename_trans_rules	32	4	12.5%	['binpolicy-fuzzer', 'module-package-fuzzer', 'checkpolicy-fuzzer']
discard_tunables	64	19	29.68%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
expand_attributes_in_attributes	50	26	52.0%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
write_type_neveraudit_rules_to_cil	33	17	51.51%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
write_genfscon_rules_to_cil	91	24	26.37%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
write_selinux_port_rules_to_cil	56	15	26.78%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
write_selinux_node_rules_to_cil	33	11	33.33%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
write_xen_ioport_rules_to_cil	37	15	40.54%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
write_xen_iomem_rules_to_cil	37	14	37.83%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
write_type_neveraudit_rules_to_conf	33	17	51.51%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
write_genfscon_rules_to_conf	91	24	26.37%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
write_selinux_port_rules_to_conf	56	15	26.78%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
write_selinux_node_rules_to_conf	33	11	33.33%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
write_xen_iomem_rules_to_conf	35	13	37.14%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
write_xen_ioport_rules_to_conf	35	14	40.0%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
link_modules	82	28	34.14%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
avrule_write	83	25	30.12%	['binpolicy-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer']
filename_trans_rule_write	42	12	28.57%	['binpolicy-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer']
ocontext_write_selinux	127	62	48.81%	['binpolicy-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer']
ocontext_write_xen	109	29	26.60%	['binpolicy-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer']
yy_get_next_buffer	89	47	52.80%	['checkpolicy-fuzzer', 'secilc-fuzzer']
define_policy	41	19	46.34%	['checkpolicy-fuzzer']
define_default_range	33	8	24.24%	['checkpolicy-fuzzer']
define_pirq_context	38	6	15.78%	['checkpolicy-fuzzer']
define_iomem_context	50	10	20.0%	['checkpolicy-fuzzer']
define_ioport_context	48	10	20.83%	['checkpolicy-fuzzer']
define_pcidevice_context	39	10	25.64%	['checkpolicy-fuzzer']
define_devicetree_context	44	11	25.0%	['checkpolicy-fuzzer']
define_port_context	77	41	53.24%	['checkpolicy-fuzzer']
define_ibendport_context	64	14	21.87%	['checkpolicy-fuzzer']
define_netif_context	49	12	24.48%	['checkpolicy-fuzzer']
define_fs_use	43	11	25.58%	['checkpolicy-fuzzer']
avrule_sort_xperms	40	20	50.0%	['checkpolicy-fuzzer']
check_assertion_avtab_match	47	18	38.29%	['binpolicy-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer']
expand_rule_helper	46	19	41.30%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
find_avtab_node	60	20	33.33%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
copy_role_trans	103	11	10.67%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
expand_filename_trans	40	10	25.0%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
expand_range_trans	40	10	25.0%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
cond_node_copy	46	5	10.86%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
class_copy_callback	68	29	42.64%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
class_copy_default_new_object	39	16	41.02%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
constraint_node_clone	87	47	54.02%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
ocontext_copy_selinux	91	37	40.65%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
ocontext_copy_xen	62	30	48.38%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
genfs_copy	47	7	14.89%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/selinux/libsepol/fuzz/secilc-fuzzer.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/optimize.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/policydb_validate.c	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/module.c	['module-package-fuzzer']	['module-package-fuzzer']
/src/selinux/libsepol/fuzz/binpolicy-fuzzer.c	['binpolicy-fuzzer']	['binpolicy-fuzzer']
/src/selinux/libselinux/src/label_x.c	[]	[]
/src/selinux/checkpolicy/y.tab.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libselinux/src/policyvers.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_deny.c	['secilc-fuzzer']	[]
/src/selinux/checkpolicy/fuzz/checkpolicy-fuzzer.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/write.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/module_to_cil.c	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/selinux_config.c	[]	[]
/src/selinux/libselinux/src/enabled.c	[]	[]
/src/selinux/libsepol/src/sidtab.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/checkpolicy/queue.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/checkpolicy/module_compiler.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libselinux/src/./label_file.h	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']	[]
/src/selinux/libsepol/src/context_record.c	[]	[]
/src/selinux/libsepol/src/kernel_to_common.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/symtab.c	['secilc-fuzzer', 'module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/usr/include/x86_64-linux-gnu/bits/uintn-identity.h	[]	[]
/src/selinux/checkpolicy/lex.yy.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libselinux/src/label_media.c	[]	[]
/src/selinux/libsepol/src/debug.c	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/selinux_internal.c	[]	[]
/src/selinux/libselinux/fuzz/selabel_file_compiled-fuzzer.c	['selabel_file_compiled-fuzzer']	['selabel_file_compiled-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_stack.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/expand.c	['secilc-fuzzer', 'module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/./selinux_internal.h	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_strpool.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/polcaps.c	['secilc-fuzzer', 'module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_list.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/label_support.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_mem.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_symtab.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/init.c	[]	[]
/src/selinux/libselinux/src/lsetfilecon.c	[]	[]
/src/selinux/libselinux/src/freecon.c	[]	[]
/src/selinux/libsepol/src/mls.c	['secilc-fuzzer', 'module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_binary.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_verify.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/label_db.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_reset_ast.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/regex.c	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
/src/selinux/libsepol/src/context.c	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_resolve_ast.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/matchpathcon.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/libselinux/fuzz/selabel_file_text-fuzzer.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/libsepol/src/util.c	['secilc-fuzzer', 'module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_copy_ast.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_build_ast.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/policydb_public.c	['secilc-fuzzer', 'module-package-fuzzer']	['module-package-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_post.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_fqn.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_log.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_find.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/kernel_to_cil.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/label.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/DESTDIR/usr/include/sepol/policydb/context.h	['secilc-fuzzer', 'module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/constraint.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/lgetfilecon.c	[]	[]
/src/selinux/libsepol/src/avrule_block.c	['secilc-fuzzer', 'module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/avtab.c	['secilc-fuzzer', 'module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_lexer.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/kernel_to_conf.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_lexer.l	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_policy.c	[]	[]
/src/selinux/libselinux/src/seusers.c	[]	[]
/src/selinux/DESTDIR/usr/include/sepol/policydb/ebitmap.h	['secilc-fuzzer', 'module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/label_file.c	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
/src/selinux/libsepol/src/assertion.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/usr/include/x86_64-linux-gnu/bits/byteswap.h	['selabel_file_compiled-fuzzer', 'checkpolicy-fuzzer']	[]
/src/selinux/libsepol/src/./private.h	['module-package-fuzzer', 'binpolicy-fuzzer']	[]
/src/selinux/libsepol/src/policydb.c	['secilc-fuzzer', 'module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_tree.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/hierarchy.c	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_parser.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/conditional.c	['secilc-fuzzer', 'module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/sha1.c	[]	[]
/src/selinux/libsepol/src/link.c	['binpolicy-fuzzer', 'checkpolicy-fuzzer']	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/check_context.c	[]	[]
/src/selinux/libsepol/src/policydb_convert.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_write_ast.c	[]	[]
/src/selinux/libsepol/src/ebitmap.c	['secilc-fuzzer', 'module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libselinux/src/setrans_client.c	[]	[]
/src/selinux/libsepol/src/services.c	['secilc-fuzzer', 'module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/libsepol/fuzz/module-package-fuzzer.c	['module-package-fuzzer']	['module-package-fuzzer']
/src/selinux/libselinux/src/callbacks.c	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
/src/selinux/DESTDIR/usr/include/sepol/policydb/mls_types.h	['secilc-fuzzer', 'module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
/src/selinux/checkpolicy/policy_scan.l	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libselinux/src/canonicalize_context.c	[]	[]
/src/selinux/checkpolicy/parse_util.c	[]	[]
/src/selinux/checkpolicy/policy_define.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/hashtab.c	['secilc-fuzzer', 'module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']	['module-package-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']

Directories in report

Directory
/src/selinux/libsepol/fuzz/
/src/selinux/libselinux/src/
/src/selinux/libsepol/src/
/src/selinux/libsepol/src/../cil/src/
/src/selinux/libsepol/src/./
/src/selinux/libselinux/src/./
/src/selinux/DESTDIR/usr/include/sepol/policydb/
/usr/include/x86_64-linux-gnu/bits/
/src/selinux/checkpolicy/
/src/selinux/libselinux/fuzz/
/src/selinux/checkpolicy/fuzz/