From: Jan Beulich <jbeulich@suse.com>
Date: Tue, 11 Feb 2014 10:14:10 +0000 (+0100)
Subject: flask: check permissions first thing in flask_security_set_bool()
X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~5590
X-Git-Url: https://dgit.raspbian.org/%22http:/www.example.com/cgi/%22https://%22%22/%22http:/www.example.com/cgi/%22https:/%22%22?a=commitdiff_plain;h=ebe867052e0f782139147015c4e91b37aa5e68f1;p=xen.git

flask: check permissions first thing in flask_security_set_bool()

Nothing else should be done if the caller isn't permitted to set
boolean values.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
---

diff --git a/xen/xsm/flask/flask_op.c b/xen/xsm/flask/flask_op.c
index cde93084c9..dddef299a2 100644
--- a/xen/xsm/flask/flask_op.c
+++ b/xen/xsm/flask/flask_op.c
@@ -326,11 +326,11 @@ static int flask_security_set_bool(struct xen_flask_boolean *arg)
 {
     int rv;
 
-    rv = flask_security_resolve_bool(arg);
+    rv = domain_has_security(current->domain, SECURITY__SETBOOL);
     if ( rv )
         return rv;
 
-    rv = domain_has_security(current->domain, SECURITY__SETBOOL);
+    rv = flask_security_resolve_bool(arg);
     if ( rv )
         return rv;