Messages in this thread Patch in this message | | | Subject | [PATCH] Reduce SELinux check on KDSKBENT/SENT ioctls | From | Stephen Smalley <> | Date | Fri, 19 Dec 2003 10:13:13 -0500 |
| |
This patch against 2.6.0 reduces the full capability check in the SELinux module for the KDSKBENT/SENT ioctls to only check the corresponding SELinux permission, avoiding a change to the Linux permissions model for these operations. Please apply, or let me know if you'd like this resubmitted later. Thanks.
security/selinux/hooks.c | 3 +-- 1 files changed, 1 insertion(+), 2 deletions(-)
Index: linux-2.6/security/selinux/hooks.c =================================================================== RCS file: /nfshome/pal/CVS/linux-2.6/security/selinux/hooks.c,v retrieving revision 1.75 diff -u -r1.75 hooks.c --- linux-2.6/security/selinux/hooks.c 9 Oct 2003 13:03:45 -0000 1.75 +++ linux-2.6/security/selinux/hooks.c 21 Oct 2003 13:08:53 -0000 @@ -1992,8 +1992,7 @@ case KDSKBENT: case KDSKBSENT: - if (!capable(CAP_SYS_TTY_CONFIG)) - error = -EPERM; + error = task_has_capability(current,CAP_SYS_TTY_CONFIG); break; /* default case assumes that the command will go
-- Stephen Smalley <sds@epoch.ncsc.mil> National Security Agency
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |