LSM: generalize flag passing to security_capable

[platform/kernel/linux-rpi.git] / security / selinux / hooks.c

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 109ab51..040c843 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1794,7 +1794,7 @@ static inline u32 signal_to_av(int sig)
 
 /* Check whether a task is allowed to use a capability. */
 static int cred_has_capability(const struct cred *cred,
-                              int cap, int audit, bool initns)
+                              int cap, unsigned int opts, bool initns)
 {
        struct common_audit_data ad;
        struct av_decision avd;
@@ -1821,7 +1821,7 @@ static int cred_has_capability(const struct cred *cred,
 
        rc = avc_has_perm_noaudit(&selinux_state,
                                  sid, sid, sclass, av, 0, &avd);
-       if (audit == SECURITY_CAP_AUDIT) {
+       if (!(opts & CAP_OPT_NOAUDIT)) {
                int rc2 = avc_audit(&selinux_state,
                                    sid, sid, sclass, av, &avd, rc, &ad, 0);
                if (rc2)
@@ -2341,9 +2341,9 @@ static int selinux_capset(struct cred *new, const struct cred *old,
  */
 
 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
-                          int cap, int audit)
+                          int cap, unsigned int opts)
 {
-       return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
+       return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
 }
 
 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
@@ -2417,7 +2417,7 @@ static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
        int rc, cap_sys_admin = 0;
 
        rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
-                                SECURITY_CAP_NOAUDIT, true);
+                                CAP_OPT_NOAUDIT, true);
        if (rc == 0)
                cap_sys_admin = 1;
 
@@ -3272,11 +3272,11 @@ static int selinux_inode_getattr(const struct path *path)
 static bool has_cap_mac_admin(bool audit)
 {
        const struct cred *cred = current_cred();
-       int cap_audit = audit ? SECURITY_CAP_AUDIT : SECURITY_CAP_NOAUDIT;
+       unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
 
-       if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, cap_audit))
+       if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
                return false;
-       if (cred_has_capability(cred, CAP_MAC_ADMIN, cap_audit, true))
+       if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
                return false;
        return true;
 }
@@ -3680,7 +3680,7 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
        case KDSKBENT:
        case KDSKBSENT:
                error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
-                                           SECURITY_CAP_AUDIT, true);
+                                           CAP_OPT_NONE, true);
                break;
 
        /* default case assumes that the command will go