aboutsummaryrefslogtreecommitdiffstats
path: root/security/selinux
diff options
context:
space:
mode:
authorEric Paris <eparis@redhat.com>2010-11-15 18:36:29 -0500
committerLinus Torvalds <torvalds@linux-foundation.org>2010-11-15 15:40:01 -0800
commit12b3052c3ee8f508b2c7ee4ddd63ed03423409d8 (patch)
treeb97d0f209f363cfad94ce9d075312274e349da89 /security/selinux
parent6800e4c0ea3e96cf78953b8b5743381cb1bb9e37 (diff)
downloadkernel_samsung_smdk4412-12b3052c3ee8f508b2c7ee4ddd63ed03423409d8.tar.gz
kernel_samsung_smdk4412-12b3052c3ee8f508b2c7ee4ddd63ed03423409d8.tar.bz2
kernel_samsung_smdk4412-12b3052c3ee8f508b2c7ee4ddd63ed03423409d8.zip
capabilities/syslog: open code cap_syslog logic to fix build failure
The addition of CONFIG_SECURITY_DMESG_RESTRICT resulted in a build failure when CONFIG_PRINTK=n. This is because the capabilities code which used the new option was built even though the variable in question didn't exist. The patch here fixes this by moving the capabilities checks out of the LSM and into the caller. All (known) LSMs should have been calling the capabilities hook already so it actually makes the code organization better to eliminate the hook altogether. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: James Morris <jmorris@namei.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'security/selinux')
-rw-r--r--security/selinux/hooks.c6
1 files changed, 1 insertions, 5 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index d9154cf90ae..65fa8bf596f 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1973,14 +1973,10 @@ static int selinux_quota_on(struct dentry *dentry)
return dentry_has_perm(cred, NULL, dentry, FILE__QUOTAON);
}
-static int selinux_syslog(int type, bool from_file)
+static int selinux_syslog(int type)
{
int rc;
- rc = cap_syslog(type, from_file);
- if (rc)
- return rc;
-
switch (type) {
case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */