summaryrefslogtreecommitdiff
path: root/security/selinux/hooks.c
diff options
context:
space:
mode:
authorStephen Smalley <sds@tycho.nsa.gov>2018-12-12 18:10:56 +0300
committerPaul Moore <paul@paul-moore.com>2019-01-11 04:34:37 +0300
commite46e01eebbbcf2ff6d28ee7cae9f117e9d1572c8 (patch)
tree21fb06603d0a98d0146053922e1a93ba5ded5817 /security/selinux/hooks.c
parent3a28cff3bd4bf43f02be0c4e7933aebf3dc8197e (diff)
downloadlinux-e46e01eebbbcf2ff6d28ee7cae9f117e9d1572c8.tar.xz
selinux: stop passing MAY_NOT_BLOCK to the AVC upon follow_link
commit bda0be7ad9948 ("security: make inode_follow_link RCU-walk aware") switched selinux_inode_follow_link() to use avc_has_perm_flags() and pass down the MAY_NOT_BLOCK flag if called during RCU walk. However, the only test of MAY_NOT_BLOCK occurs during slow_avc_audit() and only if passing an inode as audit data (LSM_AUDIT_DATA_INODE). Since selinux_inode_follow_link() passes a dentry directly, passing MAY_NOT_BLOCK here serves no purpose. Switch selinux_inode_follow_link() to use avc_has_perm() and drop avc_has_perm_flags() since there are no other users. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/selinux/hooks.c')
-rw-r--r--security/selinux/hooks.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 7f6068489a02..f08a0f201967 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2925,9 +2925,8 @@ static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
if (IS_ERR(isec))
return PTR_ERR(isec);
- return avc_has_perm_flags(&selinux_state,
- sid, isec->sid, isec->sclass, FILE__READ, &ad,
- rcu ? MAY_NOT_BLOCK : 0);
+ return avc_has_perm(&selinux_state,
+ sid, isec->sid, isec->sclass, FILE__READ, &ad);
}
static noinline int audit_inode_permission(struct inode *inode,