summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRoman Kubiak <r.kubiak@samsung.com>2015-08-10 16:54:25 +0200
committerCasey Schaufler <casey@schaufler-ca.com>2015-08-10 15:15:50 -0700
commit41a2d5751616e38d1e293e3cb35a6e2bc7a03473 (patch)
tree110e07d1d5baab0d2614bb62a2c4d1d24389a4f1
parent1eddfe8edb8f85a0d7f793090abcbdf8741455de (diff)
downloadlinux-41a2d5751616e38d1e293e3cb35a6e2bc7a03473.tar.bz2
Kernel threads excluded from smack checks
Adds an ignore case for kernel tasks, so that they can access all resources. Since kernel worker threads are spawned with floor label, they are severely restricted by Smack policy. It is not an issue without onlycap, as these processes also run with root, so CAP_MAC_OVERRIDE kicks in. But with onlycap turned on, there is no way to change the label for these processes. Signed-off-by: Roman Kubiak <r.kubiak@samsung.com> Acked-by: Casey Schaufler <casey@schaufler-ca.com>
-rw-r--r--security/smack/smack_access.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index 00f6b38bffbd..bc1053fb5d1d 100644
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -639,6 +639,12 @@ int smack_privileged(int cap)
struct smack_known *skp = smk_of_current();
struct smack_onlycap *sop;
+ /*
+ * All kernel tasks are privileged
+ */
+ if (unlikely(current->flags & PF_KTHREAD))
+ return 1;
+
if (!capable(cap))
return 0;