diff options
Diffstat (limited to 'security/selinux/avc.c')
-rw-r--r-- | security/selinux/avc.c | 22 |
1 files changed, 8 insertions, 14 deletions
diff --git a/security/selinux/avc.c b/security/selinux/avc.c index f2dde268165a..db0fd9f33499 100644 --- a/security/selinux/avc.c +++ b/security/selinux/avc.c | |||
@@ -489,17 +489,14 @@ void avc_audit(u32 ssid, u32 tsid, | |||
489 | struct common_audit_data stack_data; | 489 | struct common_audit_data stack_data; |
490 | u32 denied, audited; | 490 | u32 denied, audited; |
491 | denied = requested & ~avd->allowed; | 491 | denied = requested & ~avd->allowed; |
492 | if (denied) { | 492 | if (denied) |
493 | audited = denied; | 493 | audited = denied & avd->auditdeny; |
494 | if (!(audited & avd->auditdeny)) | 494 | else if (result) |
495 | return; | ||
496 | } else if (result) { | ||
497 | audited = denied = requested; | 495 | audited = denied = requested; |
498 | } else { | 496 | else |
499 | audited = requested; | 497 | audited = requested & avd->auditallow; |
500 | if (!(audited & avd->auditallow)) | 498 | if (!audited) |
501 | return; | 499 | return; |
502 | } | ||
503 | if (!a) { | 500 | if (!a) { |
504 | a = &stack_data; | 501 | a = &stack_data; |
505 | memset(a, 0, sizeof(*a)); | 502 | memset(a, 0, sizeof(*a)); |
@@ -746,9 +743,7 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid, | |||
746 | else | 743 | else |
747 | avd = &avd_entry; | 744 | avd = &avd_entry; |
748 | 745 | ||
749 | rc = security_compute_av(ssid, tsid, tclass, requested, avd); | 746 | security_compute_av(ssid, tsid, tclass, avd); |
750 | if (rc) | ||
751 | goto out; | ||
752 | rcu_read_lock(); | 747 | rcu_read_lock(); |
753 | node = avc_insert(ssid, tsid, tclass, avd); | 748 | node = avc_insert(ssid, tsid, tclass, avd); |
754 | } else { | 749 | } else { |
@@ -770,7 +765,6 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid, | |||
770 | } | 765 | } |
771 | 766 | ||
772 | rcu_read_unlock(); | 767 | rcu_read_unlock(); |
773 | out: | ||
774 | return rc; | 768 | return rc; |
775 | } | 769 | } |
776 | 770 | ||