1 files changed, 18 insertions, 25 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index f5d304736852..c78dbec627f6 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3124,27 +3124,6 @@ static int selinux_inode_getattr(const struct path *path)
         return path_has_perm(current_cred(), path, FILE__GETATTR);
 }
 
-static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
-{
-        const struct cred *cred = current_cred();
-
-        if (!strncmp(name, XATTR_SECURITY_PREFIX,
-                     sizeof XATTR_SECURITY_PREFIX - 1)) {
-                if (!strcmp(name, XATTR_NAME_CAPS)) {
-                        if (!capable(CAP_SETFCAP))
-                                return -EPERM;
-                } else if (!capable(CAP_SYS_ADMIN)) {
-                        /* A different attribute in the security namespace.
-                           Restrict to administrator. */
-                        return -EPERM;
-                }
-        }
-
-        /* Not an attribute we recognize, so just check the
-           ordinary setattr permission. */
-        return dentry_has_perm(cred, dentry, FILE__SETATTR);
-}
-
 static bool has_cap_mac_admin(bool audit)
 {
         const struct cred *cred = current_cred();
@@ -3167,8 +3146,15 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
         u32 newsid, sid = current_sid();
         int rc = 0;
 
-        if (strcmp(name, XATTR_NAME_SELINUX))
-                return selinux_inode_setotherxattr(dentry, name);
+        if (strcmp(name, XATTR_NAME_SELINUX)) {
+                rc = cap_inode_setxattr(dentry, name, value, size, flags);
+                if (rc)
+                        return rc;
+
+                /* Not an attribute we recognize, so just check the
+                   ordinary setattr permission. */
+                return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
+        }
 
         sbsec = inode->i_sb->s_security;
         if (!(sbsec->flags & SBLABEL_MNT))
@@ -3282,8 +3268,15 @@ static int selinux_inode_listxattr(struct dentry *dentry)
 
 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
 {
-        if (strcmp(name, XATTR_NAME_SELINUX))
-                return selinux_inode_setotherxattr(dentry, name);
+        if (strcmp(name, XATTR_NAME_SELINUX)) {
+                int rc = cap_inode_removexattr(dentry, name);
+                if (rc)
+                        return rc;
+
+                /* Not an attribute we recognize, so just check the
+                   ordinary setattr permission. */
+                return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
+        }
 
         /* No one is allowed to remove a SELinux security label.
            You can change the label, but all data must be labeled. */