From: Tejun Heo <tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
To: Andrey Wagin <avagin-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
Cc: Li Zefan <lizefan-hv44wF8Li93QT0dZR+AlfA@public.gmane.org>,
Linux Containers
<containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org>,
cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
libcg-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
Subject: Re: Staring with 3.14 devices.allow can't be opened in read-write mode
Date: Mon, 12 May 2014 11:19:08 -0400 [thread overview]
Message-ID: <20140512151908.GC1421@htj.dyndns.org> (raw)
In-Reply-To: <CANaxB-xUm3rJ-Cbp72q-rQJO5mZe1qK6qXsQM=vh0U8upJ44+A-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
Hello,
On Mon, May 12, 2014 at 03:10:12PM +0400, Andrey Wagin wrote:
> I found the "devices.allow" file can't be opened in read-write mode on
> the 3.14 kernel. I uses libcgroup, which opens devices.allow with
> O_RDWR. This works fine before 3.14 and fails one 3.14. This files has
Urgh... great.
> write-only permissions. I have tried to create a regular file with the
> same permission and kernel allows to open it with O_RDWR.
> So what do you think is it a problem, which must be fixed?
That's vfs skipping permission check because the opener is root.
sysfs traditionally enforced the same permission check on root too.
cgroup switched over to kernfs and now share the same open logic with
sysfs and is now getting open failure from permission check on root
opens too.
I'll bring kernfs's behavior closer to regular files.
Thanks.
--
tejun
next prev parent reply other threads:[~2014-05-12 15:19 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-05-12 11:10 Staring with 3.14 devices.allow can't be opened in read-write mode Andrey Wagin
[not found] ` <CANaxB-xUm3rJ-Cbp72q-rQJO5mZe1qK6qXsQM=vh0U8upJ44+A-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2014-05-12 15:19 ` Tejun Heo [this message]
[not found] ` <20140512151908.GC1421-Gd/HAXX7CRxy/B6EtB590w@public.gmane.org>
2014-05-12 17:56 ` [PATCH driver-core-linus] kernfs, sysfs, cgroup: restrict extra perm check on open to sysfs Tejun Heo
[not found] ` <20140512175627.GE1421-Gd/HAXX7CRxy/B6EtB590w@public.gmane.org>
2014-05-12 20:22 ` Andrey Wagin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140512151908.GC1421@htj.dyndns.org \
--to=tj-dgejt+ai2ygdnm+yrofe0a@public.gmane.org \
--cc=avagin-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org \
--cc=cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org \
--cc=libcg-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org \
--cc=lizefan-hv44wF8Li93QT0dZR+AlfA@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).