1 files changed, 22 insertions, 2 deletions

diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 3662b0f15ec5..9da6420e2056 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -488,9 +488,29 @@ void avc_audit(u32 ssid, u32 tsid,
         struct common_audit_data stack_data;
         u32 denied, audited;
         denied = requested & ~avd->allowed;
-        if (denied)
+        if (denied) {
                 audited = denied & avd->auditdeny;
-        else if (result)
+                /*
+                 * a->selinux_audit_data.auditdeny is TRICKY!  Setting a bit in
+                 * this field means that ANY denials should NOT be audited if
+                 * the policy contains an explicit dontaudit rule for that
+                 * permission.  Take notice that this is unrelated to the
+                 * actual permissions that were denied.  As an example lets
+                 * assume:
+                 *
+                 * denied == READ
+                 * avd.auditdeny & ACCESS == 0 (not set means explicit rule)
+                 * selinux_audit_data.auditdeny & ACCESS == 1
+                 *
+                 * We will NOT audit the denial even though the denied
+                 * permission was READ and the auditdeny checks were for
+                 * ACCESS
+                 */
+                if (a &&
+                    a->selinux_audit_data.auditdeny &&
+                    !(a->selinux_audit_data.auditdeny & avd->auditdeny))
+                        audited = 0;
+        } else if (result)
                 audited = denied = requested;
         else
                 audited = requested & avd->auditallow;