[PATCH] Reduce SELinux check on KDSKBENT/SENT ioctls

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch reduces the full capability check in the SELinux module for the
KDSKBENT/SENT ioctls to only check the corresponding SELinux permission,
avoiding a change to the Linux permissions model for these operations.

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index e9301f2b0dca77b58fe7a6ac21e6bf40c68f896d..34bcfcc7aaa980662fff02cfab21a764a5cce0fe 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1992,8 +1992,7 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
 
                case KDSKBENT:
                case KDSKBSENT:
-                       if (!capable(CAP_SYS_TTY_CONFIG))
-                               error = -EPERM;
+                       error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
                        break;
 
                /* default case assumes that the command will go