From d19dfe58b7ecbef3bd0c403c650200c57913ba1b Mon Sep 17 00:00:00 2001 From: Casey Schaufler Date: Mon, 8 Jan 2018 10:25:32 -0800 Subject: Smack: Privilege check on key operations Smack: Privilege check on key operations Operations on key objects are subjected to Smack policy even if the process is privileged. This is inconsistent with the general behavior of Smack and may cause issues with authentication by privileged daemons. This patch allows processes with CAP_MAC_OVERRIDE to access keys even if the Smack rules indicate otherwise. Reported-by: Jose Bollo Signed-off-by: Casey Schaufler --- security/smack/smack.h | 1 + 1 file changed, 1 insertion(+) (limited to 'security/smack/smack.h') diff --git a/security/smack/smack.h b/security/smack/smack.h index 6a71fc7831ab..f7db791fb566 100644 --- a/security/smack/smack.h +++ b/security/smack/smack.h @@ -321,6 +321,7 @@ struct smack_known *smk_import_entry(const char *, int); void smk_insert_entry(struct smack_known *skp); struct smack_known *smk_find_entry(const char *); bool smack_privileged(int cap); +bool smack_privileged_cred(int cap, const struct cred *cred); void smk_destroy_label_list(struct list_head *list); /* -- cgit v1.2.3