Jeff Vander Stoep 2fd9e60760 vsock: use ns_capable_noaudit() on socket create ... [ Upstream commit af545bb5ee ] During __vsock_create() CAP_NET_ADMIN is used to determine if the vsock_sock->trusted should be set to true. This value is used later for determing if a remote connection should be allowed to connect to a restricted VM. Unfortunately, if the caller doesn't have CAP_NET_ADMIN, an audit message such as an selinux denial is generated even if the caller does not want a trusted socket. Logging errors on success is confusing. To avoid this, switch the capable(CAP_NET_ADMIN) check to the noaudit version. Reported-by: Roman Kiryanov <rkir@google.com> https://android-review.googlesource.com/c/device/generic/goldfish/+/1468545/ Signed-off-by: Jeff Vander Stoep <jeffv@google.com> Reviewed-by: James Morris <jamorris@linux.microsoft.com> Link: https://lore.kernel.org/r/20201023143757.377574-1-jeffv@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-11-10 12:37:30 +01:00
..
Kconfig	…
Makefile	…
af_vsock.c	vsock: use ns_capable_noaudit() on socket create	2020-11-10 12:37:30 +01:00
af_vsock_tap.c	…
diag.c	…
hyperv_transport.c	…
virtio_transport.c	vsock/virtio: add transport parameter to the virtio_transport_reset_no_sock()	2020-10-07 08:01:24 +02:00
virtio_transport_common.c	net: virtio_vsock: Enhance connection semantics	2020-10-07 08:01:24 +02:00
vmci_transport.c	…
vmci_transport.h	…
vmci_transport_notify.c	…
vmci_transport_notify.h	…
vmci_transport_notify_qstate.c	…
vsock_addr.c	…