1 files changed, 4 insertions, 1 deletions

diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 3fc8969b499c..f6195ebde3c9 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -2168,7 +2168,10 @@ static int ocontext_read(struct policydb *p, struct policydb_compat_info *info,
 
                                 rc = -EINVAL;
                                 c->v.behavior = le32_to_cpu(buf[0]);
-                                if (c->v.behavior > SECURITY_FS_USE_NONE)
+                                /* Determined at runtime, not in policy DB. */
+                                if (c->v.behavior == SECURITY_FS_USE_MNTPOINT)
+                                        goto out;
+                                if (c->v.behavior > SECURITY_FS_USE_MAX)
                                         goto out;
 
                                 rc = -ENOMEM;