selinux,smack: remove the capability checks in the removexattr hooks

Commit 61df7b828204 ("lsm: fixup the inode xattr capability handling")
moved the responsibility of doing the inode xattr capability checking
out of the individual LSMs and into the LSM framework itself.
Unfortunately, while the original commit added the capability checks
to both the setxattr and removexattr code in the LSM framework, it
only removed the setxattr capability checks from the individual LSMs,
leaving duplicated removexattr capability checks in both the SELinux
and Smack code.

This patch removes the duplicated code from SELinux and Smack.

Fixes: 61df7b828204 ("lsm: fixup the inode xattr capability handling")
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 17e6640bbf5ba738eeff45bd47aace450472b904..55c78c318ccd78b8dcec24886c0ff5e919c67b85 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3356,15 +3356,9 @@ static int selinux_inode_listxattr(struct dentry *dentry)
 static int selinux_inode_removexattr(struct mnt_idmap *idmap,
                                     struct dentry *dentry, const char *name)
 {
-       if (strcmp(name, XATTR_NAME_SELINUX)) {
-               int rc = cap_inode_removexattr(idmap, dentry, name);
-               if (rc)
-                       return rc;
-
-               /* Not an attribute we recognize, so just check the
-                  ordinary setattr permission. */
+       /* if not a selinux xattr, only check the ordinary setattr perm */
+       if (strcmp(name, XATTR_NAME_SELINUX))
                return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
-       }
 
        if (!selinux_initialized())
                return 0;

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 1833bd50d97a19a2de3d87333a27c874f60d1758..7d6d5886877565bd3dc02871b9541b10971616cd 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1461,8 +1461,7 @@ static int smack_inode_removexattr(struct mnt_idmap *idmap,
            strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
                if (!smack_privileged(CAP_MAC_ADMIN))
                        rc = -EPERM;
-       } else
-               rc = cap_inode_removexattr(idmap, dentry, name);
+       }
 
        if (rc != 0)
                return rc;