diff --git a/security/selinux/avc.c b/security/selinux/avc.c index e1efe744c6a5..857b9bf916cf 100644 --- a/security/selinux/avc.c +++ b/security/selinux/avc.c @@ -779,6 +779,10 @@ noinline int slow_avc_audit(struct selinux_state *state, if (WARN_ON(!tclass || tclass >= ARRAY_SIZE(secclass_map))) return -EINVAL; + /* Only log permissive=1 messages for SECURITY_SELINUX_DEVELOP */ + if (denied && !result) + return 0; + if (!a) { a = &stack_data; a->type = LSM_AUDIT_DATA_NONE;