diff options
| author | Micah Morton <mortonm@chromium.org> | 2019-01-08 03:10:53 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-01-23 10:21:29 +0300 |
| commit | 87ca9aaf0c0042f526452e3baa95317f9049613f (patch) | |
| tree | b5254d776cfe3ac6ab3957d4af66d49c52179dc0 /security/smack/smack_access.c | |
| parent | 991d8c73d53bb4f05b54d2cffdbd7285aaba3d77 (diff) | |
| download | linux-87ca9aaf0c0042f526452e3baa95317f9049613f.tar.xz | |
LSM: generalize flag passing to security_capable
[ Upstream commit c1a85a00ea66cb6f0bd0f14e47c28c2b0999799f ]
This patch provides a general mechanism for passing flags to the
security_capable LSM hook. It replaces the specific 'audit' flag that is
used to tell security_capable whether it should log an audit message for
the given capability check. The reason for generalizing this flag
passing is so we can add an additional flag that signifies whether
security_capable is being called by a setid syscall (which is needed by
the proposed SafeSetID LSM).
Signed-off-by: Micah Morton <mortonm@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <james.morris@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'security/smack/smack_access.c')
| -rw-r--r-- | security/smack/smack_access.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c index c071c356a963..a7855c61c05c 100644 --- a/security/smack/smack_access.c +++ b/security/smack/smack_access.c @@ -640,7 +640,7 @@ bool smack_privileged_cred(int cap, const struct cred *cred) struct smack_known_list_elem *sklep; int rc; - rc = cap_capable(cred, &init_user_ns, cap, SECURITY_CAP_AUDIT); + rc = cap_capable(cred, &init_user_ns, cap, CAP_OPT_NONE); if (rc) return false; |