BACKPORT: Kernel threads excluded from smack checks

Adds an ignore case for kernel tasks,
so that they can access all resources.

Since kernel worker threads are spawned with
floor label, they are severely restricted by
Smack policy. It is not an issue without onlycap,
as these processes also run with root,
so CAP_MAC_OVERRIDE kicks in. But with onlycap
turned on, there is no way to change the label
for these processes.

Signed-off-by: Roman Kubiak <r.kubiak@samsung.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
(cherry-picked from upstream 41a2d5751616e38d1e293e3cb35a6e2bc7a03473)

diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index 2f7ff308c6a8efaf7b7764b0780c1f9c9c50d7ba..9d86b243334df98d4c94f6b991d4aea06423f93d 100644 (file)
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -640,6 +640,12 @@ int smack_privileged(int cap)
        struct smack_known *skp = smk_of_current();
        struct smack_onlycap *sop;
 
+       /*
+        * All kernel tasks are privileged
+        */
+       if (unlikely(current->flags & PF_KTHREAD))
+               return 1;
+
        if (!capable(cap))
                return 0;