From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752342Ab1BJGMr (ORCPT ); Thu, 10 Feb 2011 01:12:47 -0500 Received: from sous-sol.org ([216.99.217.87]:45014 "EHLO sequoia.sous-sol.org" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751783Ab1BJGM3 (ORCPT ); Thu, 10 Feb 2011 01:12:29 -0500 From: Chris Wright To: linux-kernel@vger.kernel.org, Jesse Barnes Cc: Eric Paris , Don Dutile , chrisw@sous-sol.org, Greg Kroah-Hartman , Alan Cox , linux-pci@vger.kernel.org Subject: [PATCH 2/2] pci: use security_capable() when checking capablities during config space read Date: Wed, 9 Feb 2011 22:11:52 -0800 Message-Id: <1297318312-14309-3-git-send-email-chrisw@sous-sol.org> X-Mailer: git-send-email 1.7.3.4 In-Reply-To: <1297318312-14309-1-git-send-email-chrisw@sous-sol.org> References: <1297318312-14309-1-git-send-email-chrisw@sous-sol.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Eric Paris noted that commit de139a3 ("pci: check caps from sysfs file open to read device dependent config space") caused the capability check to bypass security modules and potentially auditing. Rectify this by calling security_capable() when checking the open file's capabilities for config space reads. Cc: Eric Paris Cc: Greg Kroah-Hartman Cc: Jesse Barnes Cc: Alan Cox Cc: linux-pci@vger.kernel.org Signed-off-by: Chris Wright --- drivers/pci/pci-sysfs.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c index 8ecaac9..f7771f3 100644 --- a/drivers/pci/pci-sysfs.c +++ b/drivers/pci/pci-sysfs.c @@ -23,6 +23,7 @@ #include #include #include +#include #include #include #include "pci.h" @@ -368,7 +369,7 @@ pci_read_config(struct file *filp, struct kobject *kobj, u8 *data = (u8*) buf; /* Several chips lock up trying to read undefined config space */ - if (cap_raised(filp->f_cred->cap_effective, CAP_SYS_ADMIN)) { + if (security_capable(filp->f_cred, CAP_SYS_ADMIN)) { size = dev->cfg_size; } else if (dev->hdr_type == PCI_HEADER_TYPE_CARDBUS) { size = 128; -- 1.7.3.4