projects
/
firefly-linux-kernel-4.4.55.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
[media] mceusb: tivo transceiver should default to tivo keymap
[firefly-linux-kernel-4.4.55.git]
/
security
/
selinux
/
hooks.c
diff --git
a/security/selinux/hooks.c
b/security/selinux/hooks.c
index f9c3764e48590e5737a0afddb63043b25675f23b..8fb248843009de5e6b71a01cae7b884cd597ba36 100644
(file)
--- a/
security/selinux/hooks.c
+++ b/
security/selinux/hooks.c
@@
-1446,8
+1446,11
@@
static int task_has_capability(struct task_struct *tsk,
}
rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
}
rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
- if (audit == SECURITY_CAP_AUDIT)
- avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
+ if (audit == SECURITY_CAP_AUDIT) {
+ int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
+ if (rc2)
+ return rc2;
+ }
return rc;
}
return rc;
}
@@
-1467,7
+1470,8
@@
static int task_has_system(struct task_struct *tsk,
static int inode_has_perm(const struct cred *cred,
struct inode *inode,
u32 perms,
static int inode_has_perm(const struct cred *cred,
struct inode *inode,
u32 perms,
- struct common_audit_data *adp)
+ struct common_audit_data *adp,
+ unsigned flags)
{
struct inode_security_struct *isec;
struct common_audit_data ad;
{
struct inode_security_struct *isec;
struct common_audit_data ad;
@@
-1487,7
+1491,7
@@
static int inode_has_perm(const struct cred *cred,
ad.u.fs.inode = inode;
}
ad.u.fs.inode = inode;
}
- return avc_has_perm
(sid, isec->sid, isec->sclass, perms, adp
);
+ return avc_has_perm
_flags(sid, isec->sid, isec->sclass, perms, adp, flags
);
}
/* Same as inode_has_perm, but pass explicit audit data containing
}
/* Same as inode_has_perm, but pass explicit audit data containing
@@
-1504,7
+1508,7
@@
static inline int dentry_has_perm(const struct cred *cred,
COMMON_AUDIT_DATA_INIT(&ad, FS);
ad.u.fs.path.mnt = mnt;
ad.u.fs.path.dentry = dentry;
COMMON_AUDIT_DATA_INIT(&ad, FS);
ad.u.fs.path.mnt = mnt;
ad.u.fs.path.dentry = dentry;
- return inode_has_perm(cred, inode, av, &ad);
+ return inode_has_perm(cred, inode, av, &ad
, 0
);
}
/* Check whether a task can use an open file descriptor to
}
/* Check whether a task can use an open file descriptor to
@@
-1540,7
+1544,7
@@
static int file_has_perm(const struct cred *cred,
/* av is zero if only checking access to the descriptor. */
rc = 0;
if (av)
/* av is zero if only checking access to the descriptor. */
rc = 0;
if (av)
- rc = inode_has_perm(cred, inode, av, &ad);
+ rc = inode_has_perm(cred, inode, av, &ad
, 0
);
out:
return rc;
out:
return rc;
@@
-1574,7
+1578,8
@@
static int may_create(struct inode *dir,
return rc;
if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
return rc;
if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
- rc = security_transition_sid(sid, dsec->sid, tclass, NULL, &newsid);
+ rc = security_transition_sid(sid, dsec->sid, tclass,
+ &dentry->d_name, &newsid);
if (rc)
return rc;
}
if (rc)
return rc;
}
@@
-2103,7
+2108,7
@@
static inline void flush_unauthorized_files(const struct cred *cred,
file = file_priv->file;
inode = file->f_path.dentry->d_inode;
if (inode_has_perm(cred, inode,
file = file_priv->file;
inode = file->f_path.dentry->d_inode;
if (inode_has_perm(cred, inode,
- FILE__READ | FILE__WRITE, NULL)) {
+ FILE__READ | FILE__WRITE, NULL
, 0
)) {
drop_tty = 1;
}
}
drop_tty = 1;
}
}
@@
-2635,7
+2640,7
@@
static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *na
return dentry_has_perm(cred, NULL, dentry, FILE__READ);
}
return dentry_has_perm(cred, NULL, dentry, FILE__READ);
}
-static int selinux_inode_permission(struct inode *inode, int mask)
+static int selinux_inode_permission(struct inode *inode, int mask
, unsigned flags
)
{
const struct cred *cred = current_cred();
struct common_audit_data ad;
{
const struct cred *cred = current_cred();
struct common_audit_data ad;
@@
-2657,7
+2662,7
@@
static int selinux_inode_permission(struct inode *inode, int mask)
perms = file_mask_to_av(inode->i_mode, mask);
perms = file_mask_to_av(inode->i_mode, mask);
- return inode_has_perm(cred, inode, perms, &ad);
+ return inode_has_perm(cred, inode, perms, &ad
, flags
);
}
static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
}
static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
@@
-3205,7
+3210,7
@@
static int selinux_dentry_open(struct file *file, const struct cred *cred)
* new inode label or new policy.
* This check is not redundant - do not remove.
*/
* new inode label or new policy.
* This check is not redundant - do not remove.
*/
- return inode_has_perm(cred, inode, open_file_to_av(file), NULL);
+ return inode_has_perm(cred, inode, open_file_to_av(file), NULL
, 0
);
}
/* task security operations */
}
/* task security operations */