selinux: allow dontauditx and auditallowx rules to take effect without allowx

This allows for dontauditing very specific ioctls e.g. TCGETS without
dontauditing every ioctl or granting additional permissions.

Now either an allowx, dontauditx or auditallowx rules enables checking
for extended permissions.

Signed-off-by: Jonathan Hettwer <j2468h@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 9704c8a32303f250e72f5dfe187690669512349e..597b79703584e45d9c0b5aa05d168f1ad414c831 100644 (file)
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -596,9 +596,7 @@ void services_compute_xperms_drivers(
                                        node->datum.u.xperms->driver);
        }
 
-       /* If no ioctl commands are allowed, ignore auditallow and auditdeny */
-       if (node->key.specified & AVTAB_XPERMS_ALLOWED)
-               xperms->len = 1;
+       xperms->len = 1;
 }
 
 /*