Re: [PATCH] net: Use ns_capable_noaudit() when determining net sysctl permissions

2016-10-01 Thread Dmitry Torokhov
On Sat, Oct 01, 2016 at 03:25:04AM -0400, David Miller wrote: > From: Dmitry Torokhov > Date: Fri, 30 Sep 2016 15:24:31 -0700 > > > From: Tyler Hicks > > > > The capability check should not be audited since it is only being used > > to determine the inode permissions. A failed check does not in

Re: [PATCH] net: Use ns_capable_noaudit() when determining net sysctl permissions

2016-10-01 Thread David Miller
From: Dmitry Torokhov Date: Fri, 30 Sep 2016 15:24:31 -0700 > From: Tyler Hicks > > The capability check should not be audited since it is only being used > to determine the inode permissions. A failed check does not indicate a > violation of security policy but, when an LSM is enabled, a denia

[PATCH] net: Use ns_capable_noaudit() when determining net sysctl permissions

2016-09-30 Thread Dmitry Torokhov
From: Tyler Hicks The capability check should not be audited since it is only being used to determine the inode permissions. A failed check does not indicate a violation of security policy but, when an LSM is enabled, a denial audit message was being generated. The denial audit message caused co