Re: [PATCH 3/4] cgroup: require write perm on common ancestor when moving processes on the default hierarchy

[Zefan Li <lizefan@huawei.com>]

Hi Tejun,

> -static int cgroup_procs_write_permission(struct task_struct *task)
> +static int cgroup_procs_write_permission(struct task_struct *task,
> +					 struct cgroup *dst_cgrp,
> +					 struct kernfs_open_file *of)
>  {
>  	const struct cred *cred = current_cred();
>  	const struct cred *tcred = get_task_cred(task);
> @@ -2407,6 +2409,26 @@ static int cgroup_procs_write_permission(struct task_struct *task)
>  	    !uid_eq(cred->euid, tcred->suid))
>  		ret = -EACCES;
>  
> +	if (cgroup_on_dfl(dst_cgrp)) {

if (!ret && cgroup_on_dfl(dst_cgrp))

> +		struct super_block *sb = of->file->f_path.dentry->d_sb;
> +		struct cgroup *cgrp;
> +		struct inode *inode;
> +
> +		down_read(&css_set_rwsem);
> +		cgrp = task_cgroup_from_root(task, &cgrp_dfl_root);
> +		up_read(&css_set_rwsem);
> +
> +		while (!cgroup_is_descendant(dst_cgrp, cgrp))
> +			cgrp = cgroup_parent(cgrp);
> +
> +		ret = -ENOMEM;
> +		inode = kernfs_get_inode(sb, cgrp->procs_kn);
> +		if (inode) {
> +			ret = inode_permission(inode, MAY_WRITE);
> +			iput(inode);
> +		}
> +	}
> +
>  	put_cred(tcred);
>  	return ret;
>  }