LSM: generalize flag passing to security_capable

This patch provides a general mechanism for passing flags to the
security_capable LSM hook. It replaces the specific 'audit' flag that is
used to tell security_capable whether it should log an audit message for
the given capability check. The reason for generalizing this flag
passing is so we can add an additional flag that signifies whether
security_capable is being called by a setid syscall (which is needed by
the proposed SafeSetID LSM).

Signed-off-by: Micah Morton <mortonm@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <james.morris@microsoft.com>

1 files changed, 9 insertions, 9 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index d98e1d8d18f6..b2ee49f938f1 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1578,7 +1578,7 @@ static inline u32 signal_to_av(int sig)
 
 /* Check whether a task is allowed to use a capability. */
 static int cred_has_capability(const struct cred *cred,
-                               int cap, int audit, bool initns)
+                               int cap, unsigned int opts, bool initns)
 {
         struct common_audit_data ad;
         struct av_decision avd;
@@ -1605,7 +1605,7 @@ static int cred_has_capability(const struct cred *cred,
 
         rc = avc_has_perm_noaudit(&selinux_state,
                                   sid, sid, sclass, av, 0, &avd);
-        if (audit == SECURITY_CAP_AUDIT) {
+        if (!(opts & CAP_OPT_NOAUDIT)) {
                 int rc2 = avc_audit(&selinux_state,
                                     sid, sid, sclass, av, &avd, rc, &ad, 0);
                 if (rc2)
@@ -2125,9 +2125,9 @@ static int selinux_capset(struct cred *new, const struct cred *old,
  */
 
 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
-                           int cap, int audit)
+                           int cap, unsigned int opts)
 {
-        return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
+        return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
 }
 
 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
@@ -2201,7 +2201,7 @@ static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
         int rc, cap_sys_admin = 0;
 
         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
-                                 SECURITY_CAP_NOAUDIT, true);
+                                 CAP_OPT_NOAUDIT, true);
         if (rc == 0)
                 cap_sys_admin = 1;
 
@@ -2988,11 +2988,11 @@ static int selinux_inode_getattr(const struct path *path)
 static bool has_cap_mac_admin(bool audit)
 {
         const struct cred *cred = current_cred();
-        int cap_audit = audit ? SECURITY_CAP_AUDIT : SECURITY_CAP_NOAUDIT;
+        unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
 
-        if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, cap_audit))
+        if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
                 return false;
-        if (cred_has_capability(cred, CAP_MAC_ADMIN, cap_audit, true))
+        if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
                 return false;
         return true;
 }
@@ -3387,7 +3387,7 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
         case KDSKBENT:
         case KDSKBSENT:
                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
-                                            SECURITY_CAP_AUDIT, true);
+                                            CAP_OPT_NONE, true);
                 break;
 
         /* default case assumes that the command will go