Kernel threads excluded from smack checks

Adds an ignore case for kernel tasks,
so that they can access all resources.

Since kernel worker threads are spawned with
floor label, they are severely restricted by
Smack policy. It is not an issue without onlycap,
as these processes also run with root,
so CAP_MAC_OVERRIDE kicks in. But with onlycap
turned on, there is no way to change the label
for these processes.

Change-Id: Ic0b9c0d9d5874f0299e0aba74d01c180e2722d48
Signed-off-by: Roman Kubiak <r.kubiak@samsung.com>

diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index b80d49bbf1cbfaadfcabdfeaf927406b1bfa4681..970400934d423a9df5d5d4aa192e819723b04920 100644 (file)
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -669,6 +669,12 @@ int smack_privileged(int cap)
        struct smack_known *skp = smk_of_current();
        struct smack_onlycap *sop;
 
+       /*
+        * All kernel tasks are privileged
+        */
+       if (unlikely(current->flags & PF_KTHREAD))
+               return 1;
+
        if (!capable(cap))
                return 0;