Crash of apol Type Enforcement Rule Query

[celi0n]

The Type Enforcement Rule Query of apol sometimes crashes when running a query. I'm not able to provide a reliable way of triggering it so it may be a timing related issue.

The error message is always the following:

➜  selinux ~/apps/setools/apol            
qt.qpa.plugin: Could not find the Qt platform plugin "wayland" in ""
Traceback (most recent call last):
  File "/home/celian/apps/setools/setoolsgui/widgets/models/terule.py", line 32, in data
    rule = self.item_list[row]
           ~~~~~~~~~~~~~~^^^^^
IndexError: list index out of range
[1]    6658 IOT instruction  ~/apps/setools/apol

https://github.com/SELinuxProject/setools/blob/4468cf889d1346e1ca67ca64f9461c57a8448da0/setoolsgui/widgets/models/terule.py#L32C1-L32C35

I encountered the same issue with version 4.5.1 and the version 4.4.1.

A fix could be to add this check:

if row > len(self.item_list):
    return None

But I'm not sure it is appropriate.

Thank you for your work on this project.

[pebenito]

When specifically does this happen? While you're entering criteria, after the query is complete (the progress popup disappears), or while you're scrolling through the results?

If you add the --debug option to the apol command, that will enable the debug output. It may be helpful since this doesn't reliably trigger.

[celi0n]

Ok, I will use the debug option and send the output if it happens again.

It happens when I click on "Run", but not sure if it is when the query is complete or before.

Lately I've been using the version with my quick "if" patch and it never crashed again, i will remove it for testing.

[celi0n]

Here is the log:

2025-09-26 18:50:55,649|DEBUG|setoolsgui.widgets.criteria.type|Setting target '.'
2025-09-26 18:50:55,693|DEBUG|setoolsgui.widgets.criteria.type|Error setting target: . is not a valid type attribute
Traceback (most recent call last):
  File "/home/user/apps/setools/setoolsgui/widgets/criteria/name.py", line 179, in set_criteria
    setattr(self.query, name, self.criteria.text())
  File "/home/user/apps/setools/setools/descriptors.py", line 89, in __set__
    setattr(obj, self.name, lookup(value))
                            ^^^^^^^^^^^^^
  File "setools/policyrep/selinuxpolicy.pxi", line 420, in setools.policyrep.SELinuxPolicy.lookup_type_or_attr
setools.exception.InvalidType: . is not a valid type attribute
2025-09-26 18:50:55,720|DEBUG|setoolsgui.widgets.criteria.type|Setting target_regex True
2025-09-26 18:50:55,721|DEBUG|setoolsgui.widgets.criteria.type|Setting target '.'
2025-09-26 18:51:00,609|DEBUG|setoolsgui.widgets.criteria.type|Setting target '.*name2.*'
2025-09-26 18:51:00,673|DEBUG|setoolsgui.widgets.terulequery|Calculated 126590 max results for selected ruletypes.
2025-09-26 18:51:00,678|INFO|setools.terulequery|Generating TE rule results from /home/user/Documents/experiment/selinux/policy.31
2025-09-26 18:51:00,678|DEBUG|setools.terulequery|Ruletypes: frozenset({<TERuletype.type_transition: 16>, <TERuletype.allow: 1>, <TERuletype.auditallowxperm: 512>, <TERuletype.auditallow: 2>, <TERuletype.dontauditxperm: 1024>, <TERuletype.allowxperm: 256>, <TERuletype.type_change: 64>, <TERuletype.type_member: 32>, <TERuletype.dontaudit: 4>})
2025-09-26 18:51:00,678|DEBUG|setools.terulequery|Source: re.compile('.*_name1'), indirect: True, regex: True
2025-09-26 18:51:00,678|DEBUG|setools.terulequery|Target: re.compile('.*name2.*'), indirect: True, regex: True
2025-09-26 18:51:00,678|DEBUG|setools.terulequery|Class: None, regex: False
2025-09-26 18:51:00,678|DEBUG|setools.terulequery|Perms: None, regex: False, eq: False, subset: False
2025-09-26 18:51:00,678|DEBUG|setools.terulequery|Xperms: None, eq: False
2025-09-26 18:51:00,678|DEBUG|setools.terulequery|Default: None, regex: False
2025-09-26 18:51:00,678|DEBUG|setools.terulequery|Boolean: None, eq: False, regex: False
2025-09-26 18:51:01,705|INFO|setools.terulequery|Generated 27 total results.
2025-09-26 18:51:01,705|INFO|setools.terulequery|Updating results in table model.
Traceback (most recent call last):
  File "/home/user/apps/setools/setoolsgui/widgets/models/terule.py", line 39, in data
    rule = self.item_list[row]
           ~~~~~~~~~~~~~~^^^^^
IndexError: list index out of range
[1]    50967 IOT instruction  ~/apps/setools/apol --debug

Not sure if the first error is related, I searched for a wrong name by mistake.
I've anonymized the research (that's why it's name1 and name2), but i don't think what I searched is important because I tried again the same research and it did not crash.

[pebenito]

Thanks,

Not sure if the first error is related, I searched for a wrong name by mistake.

I think it's not likely related. If you put a regex in a field before turning on the regex option, it will have this error under the covers. That error is what generates the error messages in the apol UI. I think that is the case here, because immediately after the error, the regex option is enabled.

I've anonymized the research (that's why it's name1 and name2), but i don't think what I searched is important because I tried again the same research and it did not crash.

I'll see what I can find with this log.