summaryrefslogtreecommitdiff
path: root/security/smack
diff options
context:
space:
mode:
authorPankaj Kumar <pankaj.k2@samsung.com>2013-12-13 13:42:22 +0400
committerCasey Schaufler <casey@schaufler-ca.com>2014-04-12 01:34:52 +0400
commit5e9ab593c2da3064136ffa1d7f712d0e957e1958 (patch)
tree118dec536c673d54ddeb44e7f917e53dd9590b9c /security/smack
parent668678185247303450e60df14569f94cf5775fea (diff)
downloadlinux-5e9ab593c2da3064136ffa1d7f712d0e957e1958.tar.xz
bugfix patch for SMACK
1. In order to remove any SMACK extended attribute from a file, a user should have CAP_MAC_ADMIN capability. But user without having this capability is able to remove SMACK64MMAP security attribute. 2. While validating size and value of smack extended attribute in smack_inode_setsecurity hook, wrong error code is returned. Signed-off-by: Pankaj Kumar <pamkaj.k2@samsung.com> Signed-off-by: Himanshu Shukla <himanshu.sh@samsung.com>
Diffstat (limited to 'security/smack')
-rw-r--r--security/smack/smack_lsm.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 787dcf12f15c..9a99f3c485cb 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1018,7 +1018,7 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name)
strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 ||
strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0 ||
- strcmp(name, XATTR_NAME_SMACKMMAP)) {
+ strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
if (!smack_privileged(CAP_MAC_ADMIN))
rc = -EPERM;
} else
@@ -2156,7 +2156,7 @@ static int smack_inode_setsecurity(struct inode *inode, const char *name,
int rc = 0;
if (value == NULL || size > SMK_LONGLABEL || size == 0)
- return -EACCES;
+ return -EINVAL;
skp = smk_import_entry(value, size);
if (skp == NULL)