The mapping for RTM_DELNSID was added in commit 387f989a60db
("selinux/nlmsg: add RTM_GETNSID"). While this message type is not
expected from userspace, other RTM_DEL* types are mapped to the more
restrictive nlmsg_write permission. Move RTM_DELNSID to nlmsg_write in
case the implementation is changed in the future.
Fixes: 387f989a60db ("selinux/nlmsg: add RTM_GETNSID")
Signed-off-by: Thiébaud Weksteen <tweek@xxxxxxxxxx>
---
security/selinux/nlmsgtab.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
index 3a95986b134f..f97e75301018 100644
--- a/security/selinux/nlmsgtab.c
+++ b/security/selinux/nlmsgtab.c
@@ -71,7 +71,7 @@ static const struct nlmsg_perm nlmsg_route_perms[] = {
{ RTM_DELMDB, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
{ RTM_GETMDB, NETLINK_ROUTE_SOCKET__NLMSG_READ },
{ RTM_NEWNSID, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
- { RTM_DELNSID, NETLINK_ROUTE_SOCKET__NLMSG_READ },
+ { RTM_DELNSID, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
{ RTM_GETNSID, NETLINK_ROUTE_SOCKET__NLMSG_READ },
{ RTM_NEWSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ },
{ RTM_GETSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ },
--
2.47.1.613.gc27f4b7a9f-goog
