SMACK: Use smk_tskacc() instead of smk_access() for proper logging

Himanshu Shukla · cschaufler · commit c9d238a18baa · 2017-01-10T09:47:20.000-08:00
smack_file_open() is first checking the capability of calling subject,
this check will skip the SMACK logging for success case. Use smk_tskacc()
for proper logging and SMACK access check.

Signed-off-by: Himanshu Shukla &lt;himanshu.sh@samsung.com&gt;
Signed-off-by: Casey Schaufler &lt;casey@schaufler-ca.com&gt;
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
@@ -1955,12 +1955,9 @@ static int smack_file_open(struct file *file, const struct cred *cred)
 	struct smk_audit_info ad;
 	int rc;
 
-	if (smack_privileged(CAP_MAC_OVERRIDE))
-		return 0;
-
 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
 	smk_ad_setfield_u_fs_path(&ad, file->f_path);
-	rc = smk_access(tsp->smk_task, smk_of_inode(inode), MAY_READ, &ad);
+	rc = smk_tskacc(tsp, smk_of_inode(inode), MAY_READ, &ad);
 	rc = smk_bu_credfile(cred, file, MAY_READ, rc);
 
 	return rc;
