Smack: Use cap_capable in privilege check (f28e783f) · Commits · 戴 / test

security/smack/smack.h

+1 −1

Original line number	Diff line number	Diff line
		@@ -320,7 +320,7 @@ int smk_netlbl_mls(int, char , struct netlbl_lsm_secattr , int);
		struct smack_known smk_import_entry(const char , int);
		void smk_insert_entry(struct smack_known *skp);
		struct smack_known smk_find_entry(const char );
		int smack_privileged(int cap);
		bool smack_privileged(int cap);
		void smk_destroy_label_list(struct list_head *list);

		/*

+11 −8

Original line number	Diff line number	Diff line
		@@ -627,35 +627,38 @@ DEFINE_MUTEX(smack_onlycap_lock);
		* Is the task privileged and allowed to be privileged
		* by the onlycap rule.
		*
		* Returns 1 if the task is allowed to be privileged, 0 if it's not.
		* Returns true if the task is allowed to be privileged, false if it's not.
		*/
		int smack_privileged(int cap)
		bool smack_privileged(int cap)
		{
		struct smack_known *skp = smk_of_current();
		struct smack_known_list_elem *sklep;
		int rc;

		/*
		* All kernel tasks are privileged
		*/
		if (unlikely(current->flags & PF_KTHREAD))
		return 1;
		return true;

		if (!capable(cap))
		return 0;
		rc = cap_capable(current_cred(), &init_user_ns, cap,
		SECURITY_CAP_AUDIT);
		if (rc)
		return false;

		rcu_read_lock();
		if (list_empty(&smack_onlycap_list)) {
		rcu_read_unlock();
		return 1;
		return true;
		}

		list_for_each_entry_rcu(sklep, &smack_onlycap_list, list) {
		if (sklep->smk_label == skp) {
		rcu_read_unlock();
		return 1;
		return true;
		}
		}
		rcu_read_unlock();

		return 0;
		return false;
		}