leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

devcgroup: fix odd behaviour when writing 'a' to devices.allow

Browse Source 
# cat /devcg/devices.list
 a *:* rwm
 # echo a > devices.allow
 # cat /devcg/devices.list
 a *:* rwm
 a 0:0 rwm

This is odd and maybe confusing.  With this patch, writing 'a' to
devices.allow will add 'a *:* rwm' to the whitelist.

Also a few fixes and updates to the document.

Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Cc: Pavel Emelyanov <xemul@openvz.org>
Cc: Serge E. Hallyn <serue@us.ibm.com>
Cc: Paul Menage <menage@google.com>
Cc: Balbir Singh <balbir@in.ibm.com>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Li Zefan 2008-07-04 10:00:07 -07:00 committed by Linus Torvalds
parent 26ff8c697a
commit d823f6bfec
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Documentation/controllers/devices.txt
View File

@ -13,7 +13,7 @@ either an integer or * for all. Access is a composition of r
The root device cgroup starts with rwm to 'all'. A child device
cgroup gets a copy of the parent. Administrators can then remove
devices from the whitelist or add new entries. A child cgroup can
never receive a device access which is denied its parent. However
never receive a device access which is denied by its parent. However
when a device access is removed from a parent it will not also be
removed from the child(ren).
@ -29,7 +29,11 @@ allows cgroup 1 to read and mknod the device usually known as
echo a > /cgroups/1/devices.deny
will remove the default 'a *:* mrw' entry.
will remove the default 'a *:* rwm' entry. Doing
echo a > /cgroups/1/devices.allow
will add the 'a *:* rwm' entry to the whitelist.
3. Security

2
security/device_cgroup.c
View File

@ -382,6 +382,8 @@ static ssize_t devcgroup_access_write(struct cgroup *cgroup, struct cftype *cft,
case 'a':
wh.type = DEV_ALL;
wh.access = ACC_MASK;
wh.major = ~0;
wh.minor = ~0;
goto handle;
case 'b':
wh.type = DEV_BLOCK;