High level conclusions

Fuzzers reach 77.22% code coverage.

Fuzzers reach 77.33% of cyclomatic complexity.

Fuzzers reach 74.28% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

1869 / 2516

Cyclomatic complexity statically reachable by fuzzers

14833 / 19179

Runtime code coverage of functions

1943 / 2516

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: selabel_file_compiled-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	98	25.8%
gold	[1:9]	17	4.48%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	8	2.11%
lawngreen	50+	256	67.5%
All colors	379	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	244	spec_node_cmp	call site: 00244	__errno_location
19	215	spec_node_cmp	call site: 00215	rspec_incomp
17	197	spec_node_cmp	call site: 00197	lspec_incomp
8	235	spec_node_cmp	call site: 00235	__errno_location
4	192	spec_node_cmp	call site: 00192	__errno_location
4	278	selabel_sub_key	call site: 00278	selabel_apply_subs
3	21	load_mmap	call site: 00021	__errno_location
3	322	regex_format_error	call site: 00322	abort
2	10	write_full	call site: 00010	close
2	118	regex_data_create	call site: 00118	pcre2_serialize_decode_8
2	312	compile_context_init	call site: 00312	pcre2_compile_context_create_8
1	13	convert_data	call site: 00013	close

Runtime coverage analysis

Covered functions

48

Functions that are reachable but not covered

58

Reachable functions

100

Percentage of reachable functions covered

42.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libselinux/fuzz/selabel_file_compiled-fuzzer.c	3
libselinux/src/callbacks.c	1
libselinux/src/label_file.c	26
libselinux/src/./label_file.h	5
/usr/include/x86_64-linux-gnu/bits/byteswap.h	3
libselinux/src/regex.c	12
libselinux/fuzz/../src/label_file.h	1

Fuzzer: selabel_file_text-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	119	38.1%
gold	[1:9]	9	2.88%
yellow	[10:29]	2	0.64%
greenyellow	[30:49]	9	2.88%
lawngreen	50+	173	55.4%
All colors	312	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
20	203	spec_node_cmp	call site: 00203	__errno_location
19	174	spec_node_cmp	call site: 00174	rspec_incomp
17	156	spec_node_cmp	call site: 00156	lspec_incomp
8	194	spec_node_cmp	call site: 00194	__errno_location
6	107	selabel_validate	call site: 00107	__errno_location
4	115	insert_spec	call site: 00115	__errno_location
4	151	spec_node_cmp	call site: 00151	__errno_location
4	237	selabel_sub_key	call site: 00237	selabel_apply_subs
3	33	process_line	call site: 00033	__errno_location
3	86	regex_format_error	call site: 00086	abort
3	100	insert_spec	call site: 00100	pthread_mutex_lock
3	259	lookup_check_node	call site: 00259	__errno_location

Runtime coverage analysis

Covered functions

46

Functions that are reachable but not covered

49

Reachable functions

80

Percentage of reachable functions covered

38.75%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libselinux/fuzz/selabel_file_text-fuzzer.c	3
libselinux/src/callbacks.c	1
libselinux/src/label_file.c	19
libselinux/src/./label_file.h	9
libselinux/src/label_support.c	3
libselinux/src/regex.c	8
libselinux/src/matchpathcon.c	1
libselinux/src/label.c	1
libselinux/fuzz/../src/label_file.h	1

Fuzzer: module-package-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	419	32.5%
gold	[1:9]	23	1.78%
yellow	[10:29]	36	2.79%
greenyellow	[30:49]	11	0.85%
lawngreen	50+	798	62.0%
All colors	1287	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
36	228	cond_read_node	call site: 00228	filename_trans_read
34	555	genfs_read	call site: 00555	range_read
23	899	cil_printf	call site: 00899	linked_blocks_to_cil
23	1096	block_to_cil	call site: 01096	avrule_list_to_cil
21	1063	block_to_cil	call site: 01063	process_typeset
19	162	policydb_read	call site: 00162	cond_read_list
18	638	validate_avrules	call site: 00638	validate_avrules
16	521	ocontext_read_selinux	call site: 00521	ocontext_read_xen
15	188	cond_read_node	call site: 00188	cond_read_av_list
12	423	role_set_expand	call site: 00423	map_ebitmap
10	779	validate_ocontexts	call site: 00779	is_valid_dt_path
9	615	validate_value	call site: 00615	validate_cond_list

Runtime coverage analysis

Covered functions

344

Functions that are reachable but not covered

83

Reachable functions

368

Percentage of reachable functions covered

77.45%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libsepol/fuzz/module-package-fuzzer.c	1
libsepol/src/debug.c	1
libsepol/src/policydb_public.c	5
libsepol/src/module.c	16
libsepol/src/policydb.c	78
libsepol/src/symtab.c	3
libsepol/src/hashtab.c	6
libsepol/src/avrule_block.c	6
libsepol/src/conditional.c	12
libsepol/src/ebitmap.c	13
libsepol/src/mls.c	7
DESTDIR/usr/include/sepol/policydb/ebitmap.h	4
libsepol/src/avtab.c	14
libsepol/src/util.c	5
libsepol/src/services.c	2
libsepol/src/./private.h	1
libsepol/src/policydb_validate.c	73
libsepol/src/expand.c	5
DESTDIR/usr/include/sepol/policydb/mls_types.h	5
libsepol/src/context.c	2
DESTDIR/usr/include/sepol/policydb/context.h	3
libsepol/src/polcaps.c	1
DESTDIR/usr/include/sepol/policydb/dtpath.h	2
libsepol/src/module_to_cil.c	80

Fuzzer: secilc-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	756	15.0%
gold	[1:9]	320	6.38%
yellow	[10:29]	167	3.33%
greenyellow	[30:49]	48	0.95%
lawngreen	50+	3721	74.2%
All colors	5012	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
70	4424	__cil_print_neverallow_failure	call site: 04424	cil_list_destroy
52	4855	filename_write_one	call site: 04855	avrule_block_write
38	4344	check_assertion_self_match	call site: 04344	check_assertion_extended_permissions
25	4396	__cil_print_classperm	call site: 04396	__cil_print_permissionx
21	4665	role_set_expand	call site: 04665	mls_semantic_range_expand
19	4041	__cil_avrulex_to_hashtable_helper	call site: 04041	__cil_avrulex_to_hashtable_helper
17	310	cil_yylex	call site: 00310	cil_yyrestart
16	4269	cil_ibendportcon_to_policydb	call site: 04269	cil_devicetreecon_to_policydb
16	4939	ocontext_write_selinux	call site: 04939	ocontext_write_xen
14	291	cil_parser	call site: 00291	cil_yylex
12	4646	role_set_expand	call site: 04646	map_ebitmap
11	2770	cil_post_db	call site: 02770	context_compare

Runtime coverage analysis

Covered functions

1155

Functions that are reachable but not covered

118

Reachable functions

1159

Percentage of reachable functions covered

89.82%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libsepol/fuzz/secilc-fuzzer.c	2
libsepol/src/../cil/src/cil_log.c	5
libsepol/src/../cil/src/cil.c	111
libsepol/src/../cil/src/cil_mem.c	6
libsepol/src/../cil/src/cil_strpool.c	6
libsepol/src/hashtab.c	7
libsepol/src/../cil/src/cil_tree.c	14
libsepol/src/../cil/src/cil_symtab.c	13
libsepol/src/symtab.c	3
libsepol/src/../cil/src/cil_list.c	11
libsepol/src/../cil/src/cil_parser.c	7
libsepol/src/../cil/src/cil_stack.c	7
libsepol/src/../cil/src/cil_lexer.l	3
libsepol/src/../cil/src/cil_lexer.c	20
libsepol/src/../cil/src/cil_build_ast.c	203
libsepol/src/../cil/src/cil_verify.c	55
libsepol/src/ebitmap.c	16
libsepol/src/../cil/src/cil_copy_ast.c	4
libsepol/src/../cil/src/cil_resolve_ast.c	97
libsepol/src/../cil/src/cil_reset_ast.c	57
libsepol/src/../cil/src/cil_fqn.c	3
libsepol/src/../cil/src/cil_post.c	75
DESTDIR/usr/include/sepol/policydb/ebitmap.h	4
libsepol/src/../cil/src/cil_deny.c	41
libsepol/src/../cil/src/cil_find.c	16
libsepol/src/polcaps.c	1
libsepol/src/../cil/src/cil_binary.c	138
libsepol/src/policydb_public.c	7
libsepol/src/policydb.c	44
libsepol/src/avrule_block.c	6
libsepol/src/conditional.c	16
libsepol/src/mls.c	5
libsepol/src/avtab.c	11
libsepol/src/util.c	4
DESTDIR/usr/include/sepol/policydb/mls_types.h	8
libsepol/src/constraint.c	2
DESTDIR/usr/include/sepol/policydb/context.h	3
libsepol/src/assertion.c	16
libsepol/src/hierarchy.c	19
libsepol/src/expand.c	5
libsepol/src/optimize.c	17
libsepol/src/write.c	35
libsepol/src/services.c	1

Fuzzer: checkpolicy-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	1910	40.2%
gold	[1:9]	253	5.33%
yellow	[10:29]	63	1.32%
greenyellow	[30:49]	39	0.82%
lawngreen	50+	2477	52.2%
All colors	4742	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
332	4372	sepol_kernel_policydb_to_cil	call site: 04372	sepol_module_policydb_to_cil
123	2021	prepare_base	call site: 02021	copy_module
58	3236	filename_trans_write	call site: 03236	avrule_block_write
50	1853	define_genfs_context_helper	call site: 01853	define_genfs_context
38	2714	check_assertion_self_match	call site: 02714	check_assertion_extended_permissions
35	1395	insert_separator	call site: 01395	define_user
35	2771	report_assertion_avtab_matches	call site: 02771	report_assertion_extended_permissions
31	3690	sepol_kernel_policydb_to_conf	call site: 03690	write_cond_av_list_to_conf
27	2445	copy_and_expand_avrule_block	call site: 02445	exp_rangetr_helper
22	2154	is_decl_requires_met	call site: 02154	debug_requirements
22	4177	write_cond_nodes_to_cil	call site: 04177	write_cond_av_list_to_cil
19	1633	define_devicetree_context	call site: 01633	define_port_context

Runtime coverage analysis

Covered functions

687

Functions that are reachable but not covered

242

Reachable functions

890

Percentage of reachable functions covered

72.81%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
checkpolicy/fuzz/checkpolicy-fuzzer.c	4
libsepol/src/debug.c	1
libsepol/src/policydb.c	62
libsepol/src/symtab.c	4
libsepol/src/hashtab.c	6
libsepol/src/avrule_block.c	9
libsepol/src/conditional.c	22
libsepol/src/ebitmap.c	12
libsepol/src/mls.c	8
DESTDIR/usr/include/sepol/policydb/ebitmap.h	4
libsepol/src/avtab.c	11
libsepol/src/util.c	4
checkpolicy/queue.c	7
checkpolicy/lex.yy.c	18
checkpolicy/policy_define.c	106
checkpolicy/policy_scan.l	5
checkpolicy/y.tab.c	2
checkpolicy/module_compiler.c	40
libsepol/src/policydb_validate.c	73
libsepol/src/expand.c	57
DESTDIR/usr/include/sepol/policydb/mls_types.h	9
DESTDIR/usr/include/sepol/policydb/context.h	6
libsepol/src/constraint.c	2
libsepol/src/context.c	2
DESTDIR/usr/include/sepol/policydb/dtpath.h	2
/usr/include/x86_64-linux-gnu/bits/byteswap.h	1
libsepol/src/polcaps.c	2
libsepol/src/link.c	32
libsepol/src/hierarchy.c	27
libsepol/src/assertion.c	17
libsepol/src/sidtab.c	3
libsepol/src/optimize.c	17
libsepol/src/kernel_to_common.c	43
libsepol/src/write.c	35
libsepol/src/services.c	1
libsepol/src/kernel_to_conf.c	75
libsepol/src/kernel_to_cil.c	76
libsepol/src/module_to_cil.c	71

Fuzzer: binpolicy-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	668	20.1%
gold	[1:9]	89	2.67%
yellow	[10:29]	47	1.41%
greenyellow	[30:49]	52	1.56%
lawngreen	50+	2466	74.2%
All colors	3322	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
38	886	check_assertion_self_match	call site: 00886	check_assertion_extended_permissions
24	3146	copy_and_expand_avrule_block	call site: 03146	exp_rangetr_helper
23	2587	block_to_cil	call site: 02587	avrule_list_to_cil
20	3220	copy_and_expand_avrule_block	call site: 03220	cond_node_copy
19	3248	constraint_expr_init	call site: 03248	expand_convert_type_set
17	960	sepol_extended_perms_to_string	call site: 00960	sepol_extended_perms_to_string
15	3114	copy_and_expand_avrule_block	call site: 03114	expand_convert_type_set
15	3130	copy_and_expand_avrule_block	call site: 03130	expand_convert_type_set
14	1244	ocontext_write_xen	call site: 01244	context_write
12	538	range_read	call site: 00538	mls_range_to_semantic
12	2808	copy_avrule_decl	call site: 02808	type_set_convert
11	750	validate_ocontexts	call site: 00750	is_valid_dt_path

Runtime coverage analysis

Covered functions

711

Functions that are reachable but not covered

87

Reachable functions

730

Percentage of reachable functions covered

88.08%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
libsepol/fuzz/binpolicy-fuzzer.c	2
libsepol/src/debug.c	1
libsepol/src/policydb.c	88
libsepol/src/symtab.c	4
libsepol/src/hashtab.c	6
libsepol/src/avrule_block.c	8
libsepol/src/conditional.c	25
libsepol/src/ebitmap.c	13
libsepol/src/mls.c	7
DESTDIR/usr/include/sepol/policydb/ebitmap.h	4
libsepol/src/avtab.c	14
libsepol/src/util.c	4
libsepol/src/services.c	3
libsepol/src/./private.h	1
libsepol/src/policydb_validate.c	73
libsepol/src/expand.c	57
DESTDIR/usr/include/sepol/policydb/mls_types.h	9
libsepol/src/context.c	2
DESTDIR/usr/include/sepol/policydb/context.h	5
libsepol/src/polcaps.c	1
DESTDIR/usr/include/sepol/policydb/dtpath.h	2
libsepol/src/sidtab.c	3
libsepol/src/optimize.c	17
libsepol/src/assertion.c	17
libsepol/src/hierarchy.c	27
libsepol/src/write.c	35
libsepol/src/kernel_to_conf.c	75
libsepol/src/kernel_to_common.c	43
libsepol/src/kernel_to_cil.c	76
libsepol/src/module_to_cil.c	71
libsepol/src/link.c	32
libsepol/src/constraint.c	2

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
cil_write_policy_conf	/src/selinux/libsepol/src/../cil/src/cil.c	2	['N/A', 'N/A']	16	0	19	3	2	204	0	902	377
cil_write_post_ast	/src/selinux/libsepol/src/../cil/src/cil.c	2	['N/A', 'N/A']	19	0	122	16	8	777	0	4839	290
selabel_file_init	/src/selinux/libselinux/src/label_file.c	3	['N/A', 'N/A', 'int']	6	0	84	8	4	39	0	337	278
selinux_file_context_verify	/src/selinux/libselinux/src/matchpathcon.c	2	['N/A', 'int']	8	0	155	28	11	53	0	258	222
sepol_get_user_sids	/src/selinux/libsepol/src/services.c	4	['int', 'N/A', 'N/A', 'N/A']	8	0	336	46	18	50	0	361	210
sepol_check_context	/src/selinux/libsepol/src/context.c	1	['N/A']	9	0	18	3	2	53	0	328	153
insert_spec	/src/selinux/libselinux/src/./label_file.h	9	['N/A', 'N/A', 'N/A', 'N/A', 'char', 'N/A', 'N/A', 'char', 'int']	4	0	1463	196	64	31	0	222	110

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

2049 / 2516

Cyclomatic complexity statically reachable by fuzzers

16445 / 19179

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

libselinux/fuzz/selabel_file_compiled-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['spec_node_cmp', 'selabel_sub_key', 'load_mmap', 'regex_format_error', 'write_full', 'regex_data_create']

libselinux/fuzz/selabel_file_text-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['spec_node_cmp', 'selabel_validate', 'insert_spec', 'selabel_sub_key', 'process_line', 'regex_format_error']

libsepol/fuzz/module-package-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['cond_read_node', 'genfs_read', 'cil_printf', 'block_to_cil', 'policydb_read', 'validate_avrules', 'ocontext_read_selinux', 'role_set_expand']

libsepol/fuzz/secilc-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['__cil_print_neverallow_failure', 'filename_write_one', 'check_assertion_self_match', '__cil_print_classperm', 'role_set_expand', '__cil_avrulex_to_hashtable_helper', 'cil_yylex', 'cil_ibendportcon_to_policydb', 'ocontext_write_selinux', 'cil_parser']

checkpolicy/fuzz/checkpolicy-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['sepol_kernel_policydb_to_cil', 'prepare_base', 'filename_trans_write', 'define_genfs_context_helper', 'check_assertion_self_match', 'insert_separator', 'report_assertion_avtab_matches', 'sepol_kernel_policydb_to_conf', 'copy_and_expand_avrule_block', 'is_decl_requires_met']

libsepol/fuzz/binpolicy-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['check_assertion_self_match', 'copy_and_expand_avrule_block', 'block_to_cil', 'constraint_expr_init', 'sepol_extended_perms_to_string', 'ocontext_write_xen', 'range_read']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
spec_node_cmp	288	71	24.65%	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
regex_load_mmap	35	18	51.42%	['selabel_file_compiled-fuzzer']
regex_format_error	56	29	51.78%	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
compat_validate	41	10	24.39%	['selabel_file_text-fuzzer']
ocontext_selinux_ibpkey_to_cil	31	10	32.25%	['binpolicy-fuzzer', 'module-package-fuzzer']
range_trans_to_cil	59	22	37.28%	['binpolicy-fuzzer', 'module-package-fuzzer', 'checkpolicy-fuzzer']
filename_trans_to_cil	54	17	31.48%	['binpolicy-fuzzer', 'module-package-fuzzer', 'checkpolicy-fuzzer']
cond_list_to_cil	33	7	21.21%	['binpolicy-fuzzer', 'module-package-fuzzer', 'checkpolicy-fuzzer']
validate_filename_trans_rules	32	4	12.5%	['binpolicy-fuzzer', 'module-package-fuzzer', 'checkpolicy-fuzzer']
__cil_cond_to_policydb_helper	82	44	53.65%	['secilc-fuzzer']
cil_avrulex_to_hashtable	148	46	31.08%	['secilc-fuzzer']
__cil_cats_to_mls_level	34	18	52.94%	['secilc-fuzzer']
cil_check_neverallow	88	46	52.27%	['secilc-fuzzer']
__cil_contexts_to_policydb	56	25	44.64%	['secilc-fuzzer']
__cil_verify_booleanif_helper	66	23	34.84%	['secilc-fuzzer']
define_policy	41	19	46.34%	['checkpolicy-fuzzer']
define_default_range	33	17	51.51%	['checkpolicy-fuzzer']
expand_attrib	66	29	43.93%	['checkpolicy-fuzzer']
define_pirq_context	42	10	23.80%	['checkpolicy-fuzzer']
define_iomem_context	50	10	20.0%	['checkpolicy-fuzzer']
define_ioport_context	48	10	20.83%	['checkpolicy-fuzzer']
define_pcidevice_context	39	10	25.64%	['checkpolicy-fuzzer']
define_devicetree_context	52	12	23.07%	['checkpolicy-fuzzer']
define_port_context	77	41	53.24%	['checkpolicy-fuzzer']
define_ibendport_context	64	14	21.87%	['checkpolicy-fuzzer']
define_netif_context	49	12	24.48%	['checkpolicy-fuzzer']
define_fs_use	43	21	48.83%	['checkpolicy-fuzzer']
avrule_sort_xperms	40	20	50.0%	['checkpolicy-fuzzer']
find_avtab_node	60	21	35.0%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
copy_role_trans	103	11	10.67%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
expand_filename_trans	40	10	25.0%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
expand_range_trans	40	10	25.0%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
cond_node_copy	46	5	10.86%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
discard_tunables	64	19	29.68%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
ocontext_copy_xen	62	30	48.38%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
write_xen_ioport_rules_to_cil	37	15	40.54%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
write_xen_iomem_rules_to_cil	37	14	37.83%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
write_xen_iomem_rules_to_conf	35	13	37.14%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
write_xen_ioport_rules_to_conf	35	14	40.0%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
ocontext_write_xen	88	30	34.09%	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']
cat_copy_callback	31	13	41.93%	['binpolicy-fuzzer']
copy_cond_list	56	10	17.85%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
copy_filename_trans_list	34	8	23.52%	['binpolicy-fuzzer', 'checkpolicy-fuzzer']
constraint_expr_to_string	295	113	38.30%	['binpolicy-fuzzer']
filename_trans_rule_write	42	12	28.57%	['secilc-fuzzer', 'binpolicy-fuzzer', 'checkpolicy-fuzzer']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_strpool.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_copy_ast.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/label_file.c	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
/src/selinux/libselinux/src/seusers.c	[]	[]
/src/selinux/libselinux/src/matchpathcon.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/checkpolicy/policy_scan.l	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libselinux/src/init.c	[]	[]
/src/selinux/libsepol/src/policydb_convert.c	[]	[]
/src/selinux/libsepol/src/context_record.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_verify.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_binary.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/avtab.c	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libselinux/src/label_db.c	[]	[]
/src/selinux/libsepol/src/context.c	['module-package-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/write.c	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_find.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_deny.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/symtab.c	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/optimize.c	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/checkpolicy/y.tab.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/debug.c	['module-package-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_lexer.l	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/module.c	['module-package-fuzzer']	['module-package-fuzzer']
/src/selinux/libselinux/src/label_media.c	[]	[]
/src/selinux/libsepol/src/./private.h	['module-package-fuzzer', 'binpolicy-fuzzer']	[]
/src/selinux/libselinux/src/canonicalize_context.c	[]	[]
/src/selinux/libsepol/src/constraint.c	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_list.c	['secilc-fuzzer']	[]
/usr/include/x86_64-linux-gnu/bits/uintn-identity.h	[]	[]
/src/selinux/libselinux/src/selinux_config.c	[]	[]
/src/selinux/libselinux/src/check_context.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_tree.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/sha1.c	[]	[]
/src/selinux/checkpolicy/parse_util.c	[]	[]
/src/selinux/libsepol/src/kernel_to_cil.c	['checkpolicy-fuzzer', 'binpolicy-fuzzer']	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/fuzz/secilc-fuzzer.c	['secilc-fuzzer']	['secilc-fuzzer']
/src/selinux/DESTDIR/usr/include/sepol/policydb/mls_types.h	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libselinux/src/label_support.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/libselinux/src/lsetfilecon.c	[]	[]
/src/selinux/libselinux/fuzz/selabel_file_text-fuzzer.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/libselinux/src/policyvers.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_parser.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/selinux_internal.c	[]	[]
/src/selinux/libsepol/src/policydb.c	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/link.c	['checkpolicy-fuzzer', 'binpolicy-fuzzer']	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/sidtab.c	['checkpolicy-fuzzer', 'binpolicy-fuzzer']	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_mem.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_fqn.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_post.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_symtab.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/fuzz/selabel_file_compiled-fuzzer.c	['selabel_file_compiled-fuzzer']	['selabel_file_compiled-fuzzer']
/src/selinux/libsepol/fuzz/binpolicy-fuzzer.c	['binpolicy-fuzzer']	['binpolicy-fuzzer']
/src/selinux/DESTDIR/usr/include/sepol/policydb/ebitmap.h	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_reset_ast.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_write_ast.c	[]	[]
/src/selinux/libsepol/src/module_to_cil.c	['module-package-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/expand.c	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libselinux/src/label.c	['selabel_file_text-fuzzer']	['selabel_file_text-fuzzer']
/src/selinux/libsepol/src/ebitmap.c	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libselinux/src/label_x.c	[]	[]
/usr/include/x86_64-linux-gnu/bits/byteswap.h	['selabel_file_compiled-fuzzer', 'checkpolicy-fuzzer']	[]
/src/selinux/libselinux/src/setrans_client.c	[]	[]
/src/selinux/DESTDIR/usr/include/sepol/policydb/context.h	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libselinux/src/enabled.c	[]	[]
/src/selinux/libselinux/src/freecon.c	[]	[]
/src/selinux/libsepol/src/assertion.c	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_resolve_ast.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/kernel_to_common.c	['checkpolicy-fuzzer', 'binpolicy-fuzzer']	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libselinux/src/callbacks.c	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
/src/selinux/libselinux/src/./label_file.h	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']	[]
/src/selinux/libsepol/src/mls.c	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_policy.c	[]	[]
/src/selinux/libsepol/src/../cil/src/cil_lexer.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/fuzz/module-package-fuzzer.c	['module-package-fuzzer']	['module-package-fuzzer']
/src/selinux/libselinux/src/lgetfilecon.c	[]	[]
/src/selinux/libsepol/src/avrule_block.c	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/polcaps.c	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/checkpolicy/module_compiler.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/kernel_to_conf.c	['checkpolicy-fuzzer', 'binpolicy-fuzzer']	['checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/conditional.c	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/policydb_validate.c	['module-package-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/util.c	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_stack.c	['secilc-fuzzer']	[]
/src/selinux/DESTDIR/usr/include/sepol/policydb/dtpath.h	['module-package-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	[]
/src/selinux/libsepol/src/policydb_public.c	['module-package-fuzzer', 'secilc-fuzzer']	['module-package-fuzzer', 'secilc-fuzzer']
/src/selinux/checkpolicy/queue.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libselinux/src/./selinux_internal.h	[]	[]
/src/selinux/checkpolicy/fuzz/checkpolicy-fuzzer.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/checkpolicy/lex.yy.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/../cil/src/cil_build_ast.c	['secilc-fuzzer']	[]
/src/selinux/libsepol/src/../cil/src/cil_log.c	['secilc-fuzzer']	[]
/src/selinux/libselinux/src/regex.c	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']	['selabel_file_compiled-fuzzer', 'selabel_file_text-fuzzer']
/src/selinux/checkpolicy/policy_define.c	['checkpolicy-fuzzer']	['checkpolicy-fuzzer']
/src/selinux/libsepol/src/hashtab.c	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/services.c	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['module-package-fuzzer', 'secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']
/src/selinux/libsepol/src/hierarchy.c	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']	['secilc-fuzzer', 'checkpolicy-fuzzer', 'binpolicy-fuzzer']

Directories in report

Directory
/src/selinux/libsepol/src/
/src/selinux/checkpolicy/
/src/selinux/libsepol/src/./
/src/selinux/checkpolicy/fuzz/
/usr/include/x86_64-linux-gnu/bits/
/src/selinux/libselinux/fuzz/
/src/selinux/libselinux/src/
/src/selinux/libselinux/src/./
/src/selinux/DESTDIR/usr/include/sepol/policydb/
/src/selinux/libsepol/fuzz/
/src/selinux/libsepol/src/../cil/src/