diff options
| author | Stephen Smalley <sds@tycho.nsa.gov> | 2017-03-10 12:14:18 -0500 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2017-03-29 17:33:11 -0400 |
| commit | 2a4c22426955d4fc04069811997b7390c0fb858e (patch) | |
| tree | 5ca50881e92de4a8c25947b4adc2d8dd53bc01a5 /security/selinux/ss/services.c | |
| parent | 710a0647ba955abd25460c36a09d80fdbe878273 (diff) | |
| download | talos-obmc-linux-2a4c22426955d4fc04069811997b7390c0fb858e.tar.gz talos-obmc-linux-2a4c22426955d4fc04069811997b7390c0fb858e.zip | |
fs: switch order of CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH checks
generic_permission() presently checks CAP_DAC_OVERRIDE prior to
CAP_DAC_READ_SEARCH. This can cause misleading audit messages when
using a LSM such as SELinux or AppArmor, since CAP_DAC_OVERRIDE
may not be required for the operation. Flip the order of the
tests so that CAP_DAC_OVERRIDE is only checked when required for
the operation.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: John Johansen <john.johansen@canonical.com>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
Acked-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/selinux/ss/services.c')
0 files changed, 0 insertions, 0 deletions
