Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android

[Dmitry Torokhov <dmitry.torokhov-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>]

On Mon, Oct 03, 2016 at 09:41:30PM -0700, John Stultz wrote:
> +#ifdef CONFIG_CGROUP_NICE_ATTACH
> +int cgroup_nice_allow_attach(struct cgroup_taskset *tset)
> +{
> +	const struct cred *cred = current_cred(), *tcred;
> +	struct task_struct *task;
> +	struct cgroup_subsys_state *css;
> +
> +	if (capable(CAP_SYS_NICE))
> +		return 0;
> +
> +	cgroup_taskset_for_each(task, css, tset) {
> +		tcred = __task_cred(task);

__task_cred() requires RCU lock (courtesy Ricky Z).

> +
> +		if (current != task && !uid_eq(cred->euid, tcred->uid) &&
> +		    !uid_eq(cred->euid, tcred->suid))
> +			return -EACCES;
> +	}
> +
> +	return 0;
> +}
> +#endif

Thanks.

-- 
Dmitry