* [PATCH 0/3] Rebase device_cgroup v2 patchset
@ 2012-10-19 21:16 Aristeu Rozanski
2012-10-19 21:16 ` [PATCH 1/3] device_cgroup: rename deny_all to behavior Aristeu Rozanski
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Aristeu Rozanski @ 2012-10-19 21:16 UTC (permalink / raw)
To: linux-kernel
Cc: Dave Jones, Andrew Morton, Tejun Heo, Li Zefan, James Morris,
Pavel Emelyanov, Serge Hallyn, Jiri Slaby, cgroups
This patchset rebases the v2 of the patchset since the v1 was pushed into -rc1
instead. The last patch, not present on previous patchset, fixes the
permission check when allowing everything in a cgroup.
device_cgroup.c | 87 +++++++++++++++++++++++++++++++++++++++-----------------
1 file changed, 61 insertions(+), 26 deletions(-)
Cc: Dave Jones <davej@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Li Zefan <lizefan@huawei.com>
Cc: James Morris <jmorris@namei.org>
Cc: Pavel Emelyanov <xemul@openvz.org>
Cc: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Aristeu Rozanski <aris@redhat.com>
--
Aristeu
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/3] device_cgroup: rename deny_all to behavior
2012-10-19 21:16 [PATCH 0/3] Rebase device_cgroup v2 patchset Aristeu Rozanski
@ 2012-10-19 21:16 ` Aristeu Rozanski
2012-10-19 21:45 ` Jiri Slaby
2012-10-19 21:16 ` [PATCH 2/3] device_cgroup: stop using simple_strtoul() Aristeu Rozanski
2012-10-19 21:16 ` [PATCH 3/3] device_cgroup: add proper checking when changing default behavior Aristeu Rozanski
2 siblings, 1 reply; 6+ messages in thread
From: Aristeu Rozanski @ 2012-10-19 21:16 UTC (permalink / raw)
To: linux-kernel
Cc: Dave Jones, Andrew Morton, Tejun Heo, Li Zefan, James Morris,
Pavel Emelyanov, Serge Hallyn, Jiri Slaby, cgroups
[-- Attachment #1: deny_all.patch --]
[-- Type: text/plain, Size: 3662 bytes --]
This was done in a v2 patch but v1 ended up being committed. The variable name
is less confusing and stores the default behavior when no matching exception
exists.
Cc: Dave Jones <davej@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Li Zefan <lizefan@huawei.com>
Cc: James Morris <jmorris@namei.org>
Cc: Pavel Emelyanov <xemul@openvz.org>
Cc: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
security/device_cgroup.c | 25 ++++++++++++++-----------
1 file changed, 14 insertions(+), 11 deletions(-)
--- github.orig/security/device_cgroup.c 2012-10-19 16:35:37.936804289 -0400
+++ github/security/device_cgroup.c 2012-10-19 16:35:46.366102913 -0400
@@ -42,7 +42,10 @@ struct dev_exception_item {
struct dev_cgroup {
struct cgroup_subsys_state css;
struct list_head exceptions;
- bool deny_all;
+ enum {
+ DEVCG_DEFAULT_ALLOW,
+ DEVCG_DEFAULT_DENY,
+ } behavior;
};
static inline struct dev_cgroup *css_to_devcgroup(struct cgroup_subsys_state *s)
@@ -182,13 +185,13 @@ static struct cgroup_subsys_state *devcg
parent_cgroup = cgroup->parent;
if (parent_cgroup == NULL)
- dev_cgroup->deny_all = false;
+ dev_cgroup->behavior = DEVCG_DEFAULT_ALLOW;
else {
parent_dev_cgroup = cgroup_to_devcgroup(parent_cgroup);
mutex_lock(&devcgroup_mutex);
ret = dev_exceptions_copy(&dev_cgroup->exceptions,
&parent_dev_cgroup->exceptions);
- dev_cgroup->deny_all = parent_dev_cgroup->deny_all;
+ dev_cgroup->behavior = parent_dev_cgroup->behavior;
mutex_unlock(&devcgroup_mutex);
if (ret) {
kfree(dev_cgroup);
@@ -260,7 +263,7 @@ static int devcgroup_seq_read(struct cgr
* - List the exceptions in case the default policy is to deny
* This way, the file remains as a "whitelist of devices"
*/
- if (devcgroup->deny_all == false) {
+ if (devcgroup->behavior == DEVCG_DEFAULT_ALLOW) {
set_access(acc, ACC_MASK);
set_majmin(maj, ~0);
set_majmin(min, ~0);
@@ -314,12 +317,12 @@ if (ex->minor != ~0 && ex->minor != re
* In two cases we'll consider this new exception valid:
* - the dev cgroup has its default policy to allow + exception list:
* the new exception should *not* match any of the exceptions
- * (!deny_all, !match)
+ * (behavior == DEVCG_DEFAULT_ALLOW, !match)
* - the dev cgroup has its default policy to deny + exception list:
* the new exception *should* match the exceptions
- * (deny_all, match)
+ * (behavior == DEVCG_DEFAULT_DENY, match)
*/
- if (dev_cgroup->deny_all == match)
+ if ((dev_cgroup->behavior == DEVCG_DEFAULT_DENY) == match)
return 1;
return 0;
}
@@ -375,11 +378,11 @@ memset(&ex, 0, sizeof(ex));
if (!parent_has_perm(devcgroup, &ex))
return -EPERM;
dev_exception_clean(devcgroup);
- devcgroup->deny_all = false;
+ devcgroup->behavior = DEVCG_DEFAULT_ALLOW;
break;
case DEVCG_DENY:
dev_exception_clean(devcgroup);
- devcgroup->deny_all = true;
+ devcgroup->behavior = DEVCG_DEFAULT_DENY;
break;
default:
return -EINVAL;
@@ -452,7 +455,7 @@ case '\0':
* an matching exception instead. And be silent about it: we
* don't want to break compatibility
*/
- if (devcgroup->deny_all == false) {
+ if (devcgroup->behavior == DEVCG_DEFAULT_ALLOW) {
dev_exception_rm(devcgroup, &ex);
return 0;
}
@@ -463,7 +466,7 @@ return 0;
* an matching exception instead. And be silent about it: we
* don't want to break compatibility
*/
- if (devcgroup->deny_all == true) {
+ if (devcgroup->behavior == DEVCG_DEFAULT_DENY) {
dev_exception_rm(devcgroup, &ex);
return 0;
}
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 2/3] device_cgroup: stop using simple_strtoul()
2012-10-19 21:16 [PATCH 0/3] Rebase device_cgroup v2 patchset Aristeu Rozanski
2012-10-19 21:16 ` [PATCH 1/3] device_cgroup: rename deny_all to behavior Aristeu Rozanski
@ 2012-10-19 21:16 ` Aristeu Rozanski
2012-10-19 21:16 ` [PATCH 3/3] device_cgroup: add proper checking when changing default behavior Aristeu Rozanski
2 siblings, 0 replies; 6+ messages in thread
From: Aristeu Rozanski @ 2012-10-19 21:16 UTC (permalink / raw)
To: linux-kernel
Cc: Dave Jones, Andrew Morton, Tejun Heo, Li Zefan, James Morris,
Pavel Emelyanov, Serge Hallyn, Jiri Slaby, cgroups
[-- Attachment #1: kstrtou32.patch --]
[-- Type: text/plain, Size: 1891 bytes --]
This patch converts the code to use kstrtou32() instead of simple_strtoul()
which is deprecated. The real size of the variables are u32, so use kstrtou32
instead of kstrtoul
Cc: Dave Jones <davej@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Li Zefan <lizefan@huawei.com>
Cc: James Morris <jmorris@namei.org>
Cc: Pavel Emelyanov <xemul@openvz.org>
Cc: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
security/device_cgroup.c | 28 ++++++++++++++++++++++------
1 file changed, 22 insertions(+), 6 deletions(-)
--- github.orig/security/device_cgroup.c 2012-10-19 16:35:46.366102913 -0400
+++ github/security/device_cgroup.c 2012-10-19 16:35:50.801229331 -0400
@@ -361,8 +361,8 @@ static int devcgroup_update_access(struc
int filetype, const char *buffer)
{
const char *b;
- char *endp;
- int count;
+ char temp[12]; /* 11 + 1 characters needed for a u32 */
+ int count, rc;
struct dev_exception_item ex;
if (!capable(CAP_SYS_ADMIN))
@@ -405,8 +405,16 @@ return 0;
ex.major = ~0;
b++;
} else if (isdigit(*b)) {
- ex.major = simple_strtoul(b, &endp, 10);
- b = endp;
+ memset(temp, 0, sizeof(temp));
+ for (count = 0; count < sizeof(temp) - 1; count++) {
+ temp[count] = *b;
+ b++;
+ if (!isdigit(*b))
+ break;
+ }
+ rc = kstrtou32(temp, 10, &ex.major);
+ if (rc)
+ return -EINVAL;
} else {
return -EINVAL;
}
@@ -419,8 +427,16 @@ ex.major = simple_strtoul(b, &endp, 10
ex.minor = ~0;
b++;
} else if (isdigit(*b)) {
- ex.minor = simple_strtoul(b, &endp, 10);
- b = endp;
+ memset(temp, 0, sizeof(temp));
+ for (count = 0; count < sizeof(temp) - 1; count++) {
+ temp[count] = *b;
+ b++;
+ if (!isdigit(*b))
+ break;
+ }
+ rc = kstrtou32(temp, 10, &ex.minor);
+ if (rc)
+ return -EINVAL;
} else {
return -EINVAL;
}
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 3/3] device_cgroup: add proper checking when changing default behavior
2012-10-19 21:16 [PATCH 0/3] Rebase device_cgroup v2 patchset Aristeu Rozanski
2012-10-19 21:16 ` [PATCH 1/3] device_cgroup: rename deny_all to behavior Aristeu Rozanski
2012-10-19 21:16 ` [PATCH 2/3] device_cgroup: stop using simple_strtoul() Aristeu Rozanski
@ 2012-10-19 21:16 ` Aristeu Rozanski
2 siblings, 0 replies; 6+ messages in thread
From: Aristeu Rozanski @ 2012-10-19 21:16 UTC (permalink / raw)
To: linux-kernel
Cc: Dave Jones, Andrew Morton, Tejun Heo, Li Zefan, James Morris,
Pavel Emelyanov, Serge Hallyn, Jiri Slaby, cgroups
[-- Attachment #1: fix-perm.patch --]
[-- Type: text/plain, Size: 1913 bytes --]
Before changing a group's default behavior to ALLOW, we must check if its
parent's behavior is also ALLOW.
Cc: Tejun Heo <tj@kernel.org>
Cc: Li Zefan <lizefan@huawei.com>
Cc: James Morris <jmorris@namei.org>
Cc: Pavel Emelyanov <xemul@openvz.org>
Cc: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Aristeu Rozanski <aris@redhat.com>
---
security/device_cgroup.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
--- github.orig/security/device_cgroup.c 2012-10-19 16:36:50.135790476 -0400
+++ github/security/device_cgroup.c 2012-10-19 16:48:50.710978125 -0400
@@ -344,6 +344,17 @@ static int parent_has_perm(struct dev_cg
return may_access(parent, ex);
}
+/**
+ * may_allow_all - checks if it's possible to change the behavior to
+ * allow based on parent's rules.
+ * @parent: device cgroup's parent
+ * returns: != 0 in case it's allowed, 0 otherwise
+ */
+static inline int may_allow_all(struct dev_cgroup *parent)
+{
+ return parent->behavior == DEVCG_DEFAULT_ALLOW;
+}
+
/*
* Modify the exception list using allow/deny rules.
* CAP_SYS_ADMIN is needed for this. It's at least separate from CAP_MKNOD
@@ -364,6 +375,8 @@ static int devcgroup_update_access(struc
char temp[12]; /* 11 + 1 characters needed for a u32 */
int count, rc;
struct dev_exception_item ex;
+ struct cgroup *p = devcgroup->css.cgroup;
+ struct dev_cgroup *parent = cgroup_to_devcgroup(p->parent);
if (!capable(CAP_SYS_ADMIN))
return -EPERM;
@@ -375,9 +388,13 @@ memset(&ex, 0, sizeof(ex));
case 'a':
switch (filetype) {
case DEVCG_ALLOW:
- if (!parent_has_perm(devcgroup, &ex))
+ if (!may_allow_all(parent))
return -EPERM;
dev_exception_clean(devcgroup);
+ rc = dev_exceptions_copy(&devcgroup->exceptions,
+ &parent->exceptions);
+ if (rc)
+ return rc;
devcgroup->behavior = DEVCG_DEFAULT_ALLOW;
break;
case DEVCG_DENY:
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/3] device_cgroup: rename deny_all to behavior
2012-10-19 21:16 ` [PATCH 1/3] device_cgroup: rename deny_all to behavior Aristeu Rozanski
@ 2012-10-19 21:45 ` Jiri Slaby
2012-10-22 13:35 ` Aristeu Rozanski
0 siblings, 1 reply; 6+ messages in thread
From: Jiri Slaby @ 2012-10-19 21:45 UTC (permalink / raw)
To: Aristeu Rozanski
Cc: linux-kernel, Dave Jones, Andrew Morton, Tejun Heo, Li Zefan,
James Morris, Pavel Emelyanov, Serge Hallyn, cgroups
> Signed-off-by: Jiri Slaby <jslaby@suse.cz>
R U sure? ^^^^^^^^^^^^^^^^^^^^^^^^^^^
As I don't remember myself ever seeing this patch...
Maybe I should start smoking some crap to refresh my memory?
--
js
suse labs
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/3] device_cgroup: rename deny_all to behavior
2012-10-19 21:45 ` Jiri Slaby
@ 2012-10-22 13:35 ` Aristeu Rozanski
0 siblings, 0 replies; 6+ messages in thread
From: Aristeu Rozanski @ 2012-10-22 13:35 UTC (permalink / raw)
To: Jiri Slaby
Cc: linux-kernel, Dave Jones, Andrew Morton, Tejun Heo, Li Zefan,
James Morris, Pavel Emelyanov, Serge Hallyn, cgroups
On Fri, Oct 19, 2012 at 11:45:06PM +0200, Jiri Slaby wrote:
> > Signed-off-by: Jiri Slaby <jslaby@suse.cz>
>
> R U sure? ^^^^^^^^^^^^^^^^^^^^^^^^^^^
> As I don't remember myself ever seeing this patch...
> Maybe I should start smoking some crap to refresh my memory?
argh, sorry. wanted to include everyone and ended up copying/pasting it.
will resubmit
--
Aristeu
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2012-10-22 13:35 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-10-19 21:16 [PATCH 0/3] Rebase device_cgroup v2 patchset Aristeu Rozanski
2012-10-19 21:16 ` [PATCH 1/3] device_cgroup: rename deny_all to behavior Aristeu Rozanski
2012-10-19 21:45 ` Jiri Slaby
2012-10-22 13:35 ` Aristeu Rozanski
2012-10-19 21:16 ` [PATCH 2/3] device_cgroup: stop using simple_strtoul() Aristeu Rozanski
2012-10-19 21:16 ` [PATCH 3/3] device_cgroup: add proper checking when changing default behavior Aristeu Rozanski
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).