syslog: use defined constants instead of raw numbers

Right now the syslog "type" action are just raw numbers which makes
the source difficult to follow.  This patch replaces the raw numbers
with defined constants for some level of sanity.

Signed-off-by: Kees Cook <kees.cook@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>

2 files changed, 14 insertions, 12 deletions

diff --git a/security/commoncap.c b/security/commoncap.c
index 677fad9d5cb..cf01b2eebb6 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -897,9 +897,10 @@ error:
 int cap_syslog(int type, bool from_file)
 {
         /* /proc/kmsg can open be opened by CAP_SYS_ADMIN */
-        if (type != 1 && from_file)
+        if (type != SYSLOG_ACTION_OPEN && from_file)
                 return 0;
-        if ((type != 3 && type != 10) && !capable(CAP_SYS_ADMIN))
+        if ((type != SYSLOG_ACTION_READ_ALL &&
+             type != SYSLOG_ACTION_SIZE_BUFFER) && !capable(CAP_SYS_ADMIN))
                 return -EPERM;
         return 0;
 }
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index a4862a0730f..6b36ce2eef2 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2059,20 +2059,21 @@ static int selinux_syslog(int type, bool from_file)
                 return rc;
 
         switch (type) {
-        case 3:         /* Read last kernel messages */
-        case 10:        /* Return size of the log buffer */
+        case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
+        case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
                 break;
-        case 6:         /* Disable logging to console */
-        case 7:         /* Enable logging to console */
-        case 8:         /* Set level of messages printed to console */
+        case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
+        case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
+        /* Set level of messages printed to console */
+        case SYSLOG_ACTION_CONSOLE_LEVEL:
                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
                 break;
-        case 0:         /* Close log */
-        case 1:         /* Open log */
-        case 2:         /* Read from log */
-        case 4:         /* Read/clear last kernel messages */
-        case 5:         /* Clear ring buffer */
+        case SYSLOG_ACTION_CLOSE:       /* Close log */
+        case SYSLOG_ACTION_OPEN:        /* Open log */
+        case SYSLOG_ACTION_READ:        /* Read from log */
+        case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
+        case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
         default:
                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
                 break;