Re: [PATCH RESEND 2/2] net: Use ns_capable_noaudit() when determining net sysctl permissions

2016-06-06 Thread James Morris
On Thu, 2 Jun 2016, Tyler Hicks wrote: > The capability check should not be audited since it is only being used > to determine the inode permissions. A failed check does not indicate a > violation of security policy but, when an LSM is enabled, a denial audit > message was being generated. > > Th

[PATCH RESEND 2/2] net: Use ns_capable_noaudit() when determining net sysctl permissions

2016-06-02 Thread Tyler Hicks
The capability check should not be audited since it is only being used to determine the inode permissions. A failed check does not indicate a violation of security policy but, when an LSM is enabled, a denial audit message was being generated. The denial audit message caused confusion for some app