Patch "kernel: Add noaudit variant of ns_capable()" has been added to the 4.7-stable tree

This is a note to let you know that I've just added the patch titled

kernel: Add noaudit variant of ns_capable()

to the 4.7-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
kernel-add-noaudit-variant-of-ns_capable.patch
and it can be found in the queue-4.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Tyler Hicks <[email protected]>
Date: Thu, 2 Jun 2016 23:43:21 -0500
Subject: kernel: Add noaudit variant of ns_capable()

From: Tyler Hicks <[email protected]>

commit 98f368e9e2630a3ce3e80fb10fb2e02038cf9578 upstream.

When checking the current cred for a capability in a specific user namespace, it isn't always desirable to have the LSMs audit the check. This patch adds a noaudit variant of ns_capable() for when those situations arise.

The common logic between ns_capable() and the new ns_capable_noaudit() is moved into a single, shared function to keep duplicated code to a minimum and ease maintainability.

---
 include/linux/capability.h |    5 ++++
 kernel/capability.c        |   46 +++++++++++++++++++++++++++++++++++----------
 2 files changed, 41 insertions(+), 10 deletions(-)

@@ -206,6 +206,7 @@ extern bool has_ns_capability_noaudit(st
 				      struct user_namespace *ns, int cap);
 extern bool capable(int cap);
 extern bool ns_capable(struct user_namespace *ns, int cap);
+extern bool ns_capable_noaudit(struct user_namespace *ns, int cap);
 #else
 static inline bool has_capability(struct task_struct *t, int cap)
 {

@@ -233,6 +234,10 @@ static inline bool ns_capable(struct use
 {
 	return true;
 }
+static inline bool ns_capable_noaudit(struct user_namespace *ns, int cap)
+{
+	return true;
+}
 #endif /* CONFIG_MULTIUSER */
 extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap);
 extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);

Patches currently in stable-queue which might be from [email protected] are

queue-4.7/net-use-ns_capable_noaudit-when-determining-net-sysctl-permissions.patch queue-4.7/kernel-add-noaudit-variant-of-ns_capable.patch