From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 33770C433FE for ; Mon, 7 Nov 2022 18:58:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231349AbiKGS6a (ORCPT ); Mon, 7 Nov 2022 13:58:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38208 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231481AbiKGS6Y (ORCPT ); Mon, 7 Nov 2022 13:58:24 -0500 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DC6272D779 for ; Mon, 7 Nov 2022 10:56:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1667847397; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=nZhxxyYTlaIwmmIfK4vWroJcpNA8iZbDPuwQPDMKca0=; b=dX2761zAdlQZiGcusuV4kkT69ZH1oZs7GLy79KBz70XY7XBdf9chQuQOAXzARcgM45CGsT Vl+VCVa225baxIan0a8iifL0oKSQQuBzhyz1NQ+YJLq3TW7B04Ht1vFWcrJaEsbmwDyVKO 6pEUtLMR62qlthRcUIdpk4GhNt7+o8c= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-235-hnckvliBPSKUsGqTNWLX7A-1; Mon, 07 Nov 2022 13:56:32 -0500 X-MC-Unique: hnckvliBPSKUsGqTNWLX7A-1 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 3AA52185A78F; Mon, 7 Nov 2022 18:56:32 +0000 (UTC) Received: from napanee.usersys.redhat.com (unknown [10.2.16.95]) by smtp.corp.redhat.com (Postfix) with ESMTP id 870E042222; Mon, 7 Nov 2022 18:56:30 +0000 (UTC) Received: by napanee.usersys.redhat.com (Postfix, from userid 1000) id 37D9AC0519; Mon, 7 Nov 2022 13:56:30 -0500 (EST) Date: Mon, 7 Nov 2022 13:56:30 -0500 From: Aristeu Rozanski To: Wang Weiyang Cc: paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, serge.hallyn@canonical.com, akpm@linux-foundation.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] device_cgroup: Roll back to original exceptions after copy failure Message-ID: <20221107185630.dwcffktczjrayagn@redhat.com> References: <20221025113101.41132-1-wangweiyang2@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20221025113101.41132-1-wangweiyang2@huawei.com> User-Agent: NeoMutt/20220429 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.5 Precedence: bulk List-ID: On Tue, Oct 25, 2022 at 07:31:01PM +0800, Wang Weiyang wrote: > When add the 'a *:* rwm' entry to devcgroup A's whitelist, at first A's > exceptions will be cleaned and A's behavior is changed to > DEVCG_DEFAULT_ALLOW. Then parent's exceptions will be copyed to A's > whitelist. If copy failure occurs, just return leaving A to grant > permissions to all devices. And A may grant more permissions than > parent. > > Backup A's whitelist and recover original exceptions after copy > failure. > > Fixes: 4cef7299b478 ("device_cgroup: add proper checking when changing default behavior") > Signed-off-by: Wang Weiyang > --- > security/device_cgroup.c | 33 +++++++++++++++++++++++++++++---- > 1 file changed, 29 insertions(+), 4 deletions(-) > > diff --git a/security/device_cgroup.c b/security/device_cgroup.c > index a9f8c63a96d1..bef2b9285fb3 100644 > --- a/security/device_cgroup.c > +++ b/security/device_cgroup.c > @@ -82,6 +82,17 @@ static int dev_exceptions_copy(struct list_head *dest, struct list_head *orig) > return -ENOMEM; > } > > +static void dev_exceptions_move(struct list_head *dest, struct list_head *orig) > +{ > + struct dev_exception_item *ex, *tmp; > + > + lockdep_assert_held(&devcgroup_mutex); > + > + list_for_each_entry_safe(ex, tmp, orig, list) { > + list_move_tail(&ex->list, dest); > + } > +} > + > /* > * called under devcgroup_mutex > */ > @@ -604,11 +615,13 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup, > int count, rc = 0; > struct dev_exception_item ex; > struct dev_cgroup *parent = css_to_devcgroup(devcgroup->css.parent); > + struct dev_cgroup tmp_devcgrp; > > if (!capable(CAP_SYS_ADMIN)) > return -EPERM; > > memset(&ex, 0, sizeof(ex)); > + memset(&tmp_devcgrp, 0, sizeof(tmp_devcgrp)); > b = buffer; > > switch (*b) { > @@ -620,15 +633,27 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup, > > if (!may_allow_all(parent)) > return -EPERM; > - dev_exception_clean(devcgroup); > - devcgroup->behavior = DEVCG_DEFAULT_ALLOW; > - if (!parent) > + if (!parent) { > + devcgroup->behavior = DEVCG_DEFAULT_ALLOW; > + dev_exception_clean(devcgroup); > break; > + } > > + INIT_LIST_HEAD(&tmp_devcgrp.exceptions); > + rc = dev_exceptions_copy(&tmp_devcgrp.exceptions, > + &devcgroup->exceptions); > + if (rc) > + return rc; > + dev_exception_clean(devcgroup); > rc = dev_exceptions_copy(&devcgroup->exceptions, > &parent->exceptions); > - if (rc) > + if (rc) { > + dev_exceptions_move(&devcgroup->exceptions, > + &tmp_devcgrp.exceptions); > return rc; > + } > + devcgroup->behavior = DEVCG_DEFAULT_ALLOW; > + dev_exception_clean(&tmp_devcgrp); > break; > case DEVCG_DENY: > if (css_has_online_children(&devcgroup->css)) Reviewed-by: Aristeu Rozanski -- Aristeu