fs: don't audit the capability check in simple_xattr_list()

Merge Request Required Information

Summary of Changes

fs: don't audit the capability check in simple_xattr_list()

Bugzilla: http://bugzilla.redhat.com/2151256 Tested: sanity test with xfstests -g auto and on CentOS with ausearch; the RHEL9 doesn't generate those warnings though even without fix.

commit e7eda157c4071cd1e69f4b1687b0fbe1ae5e6f46 Author: Ondrej Mosnacek omosnace@redhat.com Date: Thu Nov 3 16:12:05 2022 +0100

fs: don't audit the capability check in simple_xattr_list()

The check being unconditional may lead to unwanted denials reported by
LSMs when a process has the capability granted by DAC, but denied by an
LSM. In the case of SELinux such denials are a problem, since they can't
be effectively filtered out via the policy and when not silenced, they
produce noise that may hide a true problem or an attack.

Checking for the capability only if any trusted xattr is actually
present wouldn't really address the issue, since calling listxattr(2) on
such node on its own doesn't indicate an explicit attempt to see the
trusted xattrs. Additionally, it could potentially leak the presence of
trusted xattrs to an unprivileged user if they can check for the denials
(e.g. through dmesg).

Therefore, it's best (and simplest) to keep the check unconditional and
instead use ns_capable_noaudit() that will silence any associated LSM
denials.

Fixes: 38f38657444d ("xattr: extract simple_xattr code from tmpfs")
Reported-by: Martin Pitt <mpitt@redhat.com>
Suggested-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Reviewed-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>

Signed-off-by: Andrey Albershteyn aalbersh@redhat.com