From 38181ac4b92c29575c5c5fcce8cf9fcf76785ed1 Mon Sep 17 00:00:00 2001 From: Andrew Morton Date: Mon, 29 Dec 2003 23:42:55 -0800 Subject: [PATCH] [PATCH] Reduce SELinux check on KDSKBENT/SENT ioctls From: Stephen Smalley This patch reduces the full capability check in the SELinux module for the KDSKBENT/SENT ioctls to only check the corresponding SELinux permission, avoiding a change to the Linux permissions model for these operations. --- security/selinux/hooks.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index e9301f2b0dca7..34bcfcc7aaa98 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -1992,8 +1992,7 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd, case KDSKBENT: case KDSKBSENT: - if (!capable(CAP_SYS_TTY_CONFIG)) - error = -EPERM; + error = task_has_capability(current,CAP_SYS_TTY_CONFIG); break; /* default case assumes that the command will go -- 2.53.0