diff mbox series

[RFC,38/44] selinux: convert nlmsg_sock_has_extended_perms() to namespace-aware

Message ID 20250102164509.25606-39-stephen.smalley.work@gmail.com (mailing list archive)
State New
Delegated to: Paul Moore
Headers show
Series SELinux namespace support | expand

Commit Message

Stephen Smalley Jan. 2, 2025, 4:45 p.m. UTC 
Convert nlmsg_sock_has_extended_perms() to use the
cred_has_extended_perms() helper for namespace-aware checking.

Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
---
 security/selinux/hooks.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
diff mbox series

Patch

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 68538c74dc99..11d940fb79bd 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -6122,9 +6122,9 @@  static int nlmsg_sock_has_extended_perms(struct sock *sk, u32 perms, u16 nlmsg_t
 	driver = nlmsg_type >> 8;
 	xperm = nlmsg_type & 0xff;
 
-	return avc_has_extended_perms(current_selinux_state, current_sid(),
-				      sksec->sid, sksec->sclass, perms,
-				      driver, xperm, &ad);
+	return cred_has_extended_perms(current_cred(), sksec->sid,
+				       sksec->sclass, perms, driver, xperm,
+				       &ad);
 }
 
 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)