selinux: apply selinux checks on new audit message types



We use the read check to get the feature set (like AUDIT_GET) and the
write check to set the features (like AUDIT_SET).

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>

parent b0fed402

security/selinux/nlmsgtab.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -116,6 +116,8 @@ static struct nlmsg_perm nlmsg_audit_perms[] =
		{ AUDIT_MAKE_EQUIV, NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
		{ AUDIT_TTY_GET, NETLINK_AUDIT_SOCKET__NLMSG_READ },
		{ AUDIT_TTY_SET, NETLINK_AUDIT_SOCKET__NLMSG_TTY_AUDIT },
		{ AUDIT_GET_FEATURE, NETLINK_AUDIT_SOCKET__NLMSG_READ },
		{ AUDIT_SET_FEATURE, NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
		};