From: Li Zefan <lizf@cn.fujitsu.com>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: "Serge E. Hallyn" <serue@us.ibm.com>,
LKML <linux-kernel@vger.kernel.org>
Subject: [PATCH] devcgroup: fix odd behaviour when writing 'a' to devices.allow
Date: Fri, 04 Jul 2008 13:54:15 +0800 [thread overview]
Message-ID: <486DBB07.5050104@cn.fujitsu.com> (raw)
# cat /devcg/devices.list
a *:* rwm
# echo a > devices.allow
# cat /devcg/devices.list
a *:* rwm
a 0:0 rwm
This is odd and maybe confusing. With this patch, writing 'a'
to devices.allow will add 'a *:* rwm' to the whitelist.
Also a few fixes and updates to the document.
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
---
Documentation/controllers/devices.txt | 8 ++++++--
security/device_cgroup.c | 2 ++
2 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/Documentation/controllers/devices.txt b/Documentation/controllers/devices.txt
index 4dcea42..7cc6e6a 100644
--- a/Documentation/controllers/devices.txt
+++ b/Documentation/controllers/devices.txt
@@ -13,7 +13,7 @@ either an integer or * for all. Access is a composition of r
The root device cgroup starts with rwm to 'all'. A child device
cgroup gets a copy of the parent. Administrators can then remove
devices from the whitelist or add new entries. A child cgroup can
-never receive a device access which is denied its parent. However
+never receive a device access which is denied by its parent. However
when a device access is removed from a parent it will not also be
removed from the child(ren).
@@ -29,7 +29,11 @@ allows cgroup 1 to read and mknod the device usually known as
echo a > /cgroups/1/devices.deny
-will remove the default 'a *:* mrw' entry.
+will remove the default 'a *:* rwm' entry. Doing
+
+ echo a > /cgroups/1/devices.allow
+
+will add the 'a *:* rwm' entry to the whitelist.
3. Security
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index baf3488..fd764a0 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -382,6 +382,8 @@ static ssize_t devcgroup_access_write(struct cgroup *cgroup, struct cftype *cft,
case 'a':
wh.type = DEV_ALL;
wh.access = ACC_MASK;
+ wh.major = ~0;
+ wh.minor = ~0;
goto handle;
case 'b':
wh.type = DEV_BLOCK;
--
1.5.4.rc3
next reply other threads:[~2008-07-04 5:56 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-07-04 5:54 Li Zefan [this message]
2008-07-07 17:25 ` [PATCH] devcgroup: fix odd behaviour when writing 'a' to devices.allow Serge E. Hallyn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=486DBB07.5050104@cn.fujitsu.com \
--to=lizf@cn.fujitsu.com \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=serue@us.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.