diff options
author | Casey Schaufler <casey@schaufler-ca.com> | 2013-12-19 13:23:26 -0800 |
---|---|---|
committer | Marek Szyprowski <m.szyprowski@samsung.com> | 2014-05-15 07:25:53 +0200 |
commit | 61f00b1d2e6f22afe8bcff5e33e9a97d4b21fe9c (patch) | |
tree | c530e3c563ee985fe54a95dbbb0d27805671dabd /security | |
parent | bb33591bc45dc473a86fb563a88d2e2da7e2c77c (diff) | |
download | linux-3.10-61f00b1d2e6f22afe8bcff5e33e9a97d4b21fe9c.tar.gz linux-3.10-61f00b1d2e6f22afe8bcff5e33e9a97d4b21fe9c.tar.bz2 linux-3.10-61f00b1d2e6f22afe8bcff5e33e9a97d4b21fe9c.zip |
Smack: change rule cap check
smk_write_change_rule() is calling capable rather than
the more correct smack_privileged(). This allows for setting
rules in violation of the onlycap facility. This is the
simple repair.
Change-Id: Icb5321b5b5355d64b0b029d9131cf60b5e97d356
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Ćukasz Stelmach <l.stelmach@samsung.com>
Diffstat (limited to 'security')
-rw-r--r-- | security/smack/smackfs.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c index bd5c6e19750..6d8b8e73b15 100644 --- a/security/smack/smackfs.c +++ b/security/smack/smackfs.c @@ -2151,7 +2151,7 @@ static ssize_t smk_write_change_rule(struct file *file, const char __user *buf, /* * Must have privilege. */ - if (!capable(CAP_MAC_ADMIN)) + if (!smack_privileged(CAP_MAC_ADMIN)) return -EPERM; return smk_write_rules_list(file, buf, count, ppos, NULL, NULL, |