checkpolicy and the kernel do not agree on the binary policy file about selinux HOT 3 CLOSED

Also filename transitions are another area of divergence that could lead to differences in the binary policy image; as with range transitions, the kernel now loads them into a hashtab with deterministic order for the hash chains, whereas libsepol/checkpolicy use simple unordered lists.

from selinux.

CIL uses hashtabs for both, so possibly this will become moot and we only need to align the hashtabs in cil_binary.c to use the same parameters (number of buckets, hash function) as the kernel in order to make them consistent.

from selinux.

Fixed by commits 8fdb225 and 2e47b69. You still need to run both the policy file and the kernel-generated policy through checkpolicy as described in the commit messages before comparing, but this does permit fast and complete comparisons between the policy file and the kernel policy.

from selinux.