selinux: check neveraudit in avc_xperms_audit_required()

avc_audit_required() returns early for a neveraudit domain, while
avc_xperms_audit_required() instead relies on security_compute_av()
(and security_compute_av_user()) having already zeroed
avd->auditallow and avd->auditdeny for such a domain.  That leaves
its "else if (result)" branch as the only way left to audit a
neveraudit domain, and makes the two helpers read differently for
the same rule.

Add the same early return to avc_xperms_audit_required(), so both
audit gates state the neveraudit rule directly and the extended
permission audit path no longer depends on the auditallow/auditdeny
mask having been zeroed elsewhere.

No behavior changes today: avc_has_extended_perms() only reaches the
"result" branch once the identically computed "denied" is already
nonzero, so that branch was already unreachable in practice.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

0 files changed, 0 insertions, 0 deletions