1 files changed, 13 insertions, 13 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 28832e68980..b6c378dd4f1 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3641,32 +3641,32 @@ static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
 
 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
 {
-        struct task_security_struct *tsec;
-        struct av_decision avd;
         int err;
 
         err = secondary_ops->netlink_send(sk, skb);
         if (err)
                 return err;
 
-        tsec = current->security;
-
-        avd.allowed = 0;
-        avc_has_perm_noaudit(tsec->sid, tsec->sid,
-                                SECCLASS_CAPABILITY, ~0, &avd);
-        cap_mask(NETLINK_CB(skb).eff_cap, avd.allowed);
-
         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
                 err = selinux_nlmsg_perm(sk, skb);
 
         return err;
 }
 
-static int selinux_netlink_recv(struct sk_buff *skb)
+static int selinux_netlink_recv(struct sk_buff *skb, int capability)
 {
-        if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
-                return -EPERM;
-        return 0;
+        int err;
+        struct avc_audit_data ad;
+
+        err = secondary_ops->netlink_recv(skb, capability);
+        if (err)
+                return err;
+
+        AVC_AUDIT_DATA_INIT(&ad, CAP);
+        ad.u.cap = capability;
+
+        return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
+                            SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
 }
 
 static int ipc_alloc_security(struct task_struct *task,