linux-stable.git/security/device_cgroup.c, branch linux-3.10.y

devcg: remove parent_cgroup.

2013-04-18T18:34:35+00:00

In devcgroup_css_alloc(), there is no longer need for parent_cgroup.
bd2953ebbb("devcg: propagate local changes down the hierarchy") made
the variable parent_cgroup redundant. This patch removes parent_cgroup
from devcgroup_css_alloc().

Signed-off-by: Rami Rosen 
Acked-by: Aristeu Rozanski 
Signed-off-by: Tejun Heo

devcg: remove broken_hierarchy tag

2013-04-08T15:31:59+00:00

bd2953ebbb ("devcg: propagate local changes down the hierarchy")
implemented proper hierarchy support.  Remove the broken tag.

Signed-off-by: Tejun Heo 
Acked-by: Aristeu Rozanski

devcg: propagate local changes down the hierarchy

2013-03-20T14:50:21+00:00

This patch makes exception changes to propagate down in hierarchy respecting
when possible local exceptions.

New exceptions allowing additional access to devices won't be propagated, but
it'll be possible to add an exception to access all of part of the newly
allowed device(s).

New exceptions disallowing access to devices will be propagated down and the
local group's exceptions will be revalidated for the new situation.
Example:
      A
     / \
        B

    group        behavior          exceptions
    A            allow             "b 8:* rwm", "c 116:1 rw"
    B            deny              "c 1:3 rwm", "c 116:2 rwm", "b 3:* rwm"

If a new exception is added to group A:
	# echo "c 116:* r" > A/devices.deny
it'll propagate down and after revalidating B's local exceptions, the exception
"c 116:2 rwm" will be removed.

In case parent's exceptions change and local exceptions are not allowed anymore,
they'll be deleted.

v7:
- do not allow behavior change when the cgroup has children
- update documentation

v6: fixed issues pointed by Serge Hallyn
- only copy parent's exceptions while propagating behavior if the local
  behavior is different
- while propagating exceptions, do not clear and copy parent's: it'd be against
  the premise we don't propagate access to more devices

v5: fixed issues pointed by Serge Hallyn
- updated documentation
- not propagating when an exception is written to devices.allow
- when propagating a new behavior, clean the local exceptions list if they're
  for a different behavior

v4: fixed issues pointed by Tejun Heo
- separated function to walk the tree and collect valid propagation targets

v3: fixed issues pointed by Tejun Heo
- update documentation
- move css_online/css_offline changes to a new patch
- use cgroup_for_each_descendant_pre() instead of own descendant walk
- move exception_copy rework to a separared patch
- move exception_clean rework to a separated patch

v2: fixed issues pointed by Tejun Heo
- instead of keeping the local settings that won't apply anymore, remove them

Cc: Tejun Heo 
Cc: Serge Hallyn 
Signed-off-by: Aristeu Rozanski 
Signed-off-by: Tejun Heo

devcg: use css_online and css_offline

2013-03-20T14:50:17+00:00

Allocate resources and change behavior only when online. This is needed in
order to determine if a node is suitable for hierarchy propagation or if it's
being removed.

Locking:
Both functions take devcgroup_mutex to make changes to device_cgroup structure.
Hierarchy propagation will also take devcgroup_mutex before walking the
tree while walking the tree itself is protected by rcu lock.

Acked-by: Tejun Heo 
Acked-by: Serge Hallyn 
Cc: Tejun Heo 
Cc: Serge Hallyn 
Signed-off-by: Aristeu Rozanski 
Signed-off-by: Tejun Heo

devcg: prepare may_access() for hierarchy support

2013-03-20T14:50:13+00:00

Currently may_access() is only able to verify if an exception is valid for the
current cgroup, which has the same behavior. With hierarchy, it'll be also used
to verify if a cgroup local exception is valid towards its cgroup parent, which
might have different behavior.

v2:
- updated patch description
- rebased on top of a new patch to expand the may_access() logic to make it
  more clear
- fixed argument description order in may_access()

Acked-by: Tejun Heo 
Acked-by: Serge Hallyn 
Cc: Tejun Heo 
Cc: Serge Hallyn 
Signed-off-by: Aristeu Rozanski 
Signed-off-by: Tejun Heo

devcg: expand may_access() logic

2013-03-20T14:50:09+00:00

In order to make the next patch more clear, expand may_access() logic.

v2: may_access() returns bool now

Acked-by: Tejun Heo 
Acked-by: Serge Hallyn 
Cc: Tejun Heo 
Cc: Serge Hallyn 
Signed-off-by: Aristeu Rozanski 
Signed-off-by: Tejun Heo

device_cgroup: don't grab mutex in rcu callback

2013-02-22T01:22:15+00:00

Commit 103a197c0c4e ("security/device_cgroup: lock assert fails in
dev_exception_clean()") grabs devcgroup_mutex to fix assert failure, but
a mutex can't be grabbed in rcu callback.  Since there shouldn't be any
other references when css_free is called, mutex isn't needed for list
cleanup in devcgroup_css_free().

Signed-off-by: Jerry Snitselaar 
Acked-by: Tejun Heo 
Acked-by: Aristeu Rozanski 
Cc: James Morris 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

security/device_cgroup: lock assert fails in dev_exception_clean()

2013-01-21T13:27:55+00:00

devcgroup_css_free() calls dev_exception_clean() without the devcgroup_mutex being locked.

Shutting down a kvm virt was giving me the following trace:

[36280.732764] ------------[ cut here ]------------
[36280.732778] WARNING: at /home/snits/dev/linux/security/device_cgroup.c:172 dev_exception_clean+0xa9/0xc0()
[36280.732782] Hardware name: Studio XPS 8100
[36280.732785] Modules linked in: xt_REDIRECT fuse ebtable_nat ebtables ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat xt_CHECKSUM iptable_mangle bridge stp llc nf_conntrack_ipv4 ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 nf_defrag_ipv4 ip6table_filter it87 hwmon_vid xt_state nf_conntrack ip6_tables snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_intel snd_hda_codec snd_hwdep snd_seq coretemp snd_seq_device crc32c_intel snd_pcm snd_page_alloc snd_timer snd broadcom tg3 serio_raw i7core_edac edac_core ptp pps_core lpc_ich pcspkr mfd_core soundcore microcode i2c_i801 nfsd auth_rpcgss nfs_acl lockd vhost_net sunrpc tun macvtap macvlan kvm_intel kvm uinput binfmt_misc autofs4 usb_storage firewire_ohci firewire_core crc_itu_t radeon drm_kms_helper ttm
[36280.732921] Pid: 933, comm: libvirtd Tainted: G        W    3.8.0-rc3-00307-g4c217de #1
[36280.732922] Call Trace:
[36280.732927]  [] warn_slowpath_common+0x93/0xc0
[36280.732930]  [] warn_slowpath_null+0x1a/0x20
[36280.732932]  [] dev_exception_clean+0xa9/0xc0
[36280.732934]  [] devcgroup_css_free+0x1a/0x30
[36280.732938]  [] cgroup_diput+0x76/0x210
[36280.732941]  [] d_delete+0x120/0x180
[36280.732943]  [] vfs_rmdir+0xef/0x130
[36280.732945]  [] do_rmdir+0x107/0x1c0
[36280.732949]  [] ? trace_hardirqs_on_thunk+0x3a/0x3f
[36280.732951]  [] sys_rmdir+0x16/0x20
[36280.732954]  [] system_call_fastpath+0x16/0x1b
[36280.732956] ---[ end trace ca39dced899a7d9f ]---

Signed-off-by: Jerry Snitselaar 
Cc: stable@kernel.org
Signed-off-by: James Morris

cgroup: rename ->create/post_create/pre_destroy/destroy() to ->css_alloc/online/offline/free()

2012-11-19T16:13:38+00:00

Rename cgroup_subsys css lifetime related callbacks to better describe
what their roles are.  Also, update documentation.

Signed-off-by: Tejun Heo 
Acked-by: Li Zefan

device_cgroup: add lockdep asserts

2012-11-06T20:28:04+00:00

device_cgroup uses RCU safe ->exceptions list which is write-protected
by devcgroup_mutex and has had some issues using locking correctly.
Add lockdep asserts to utility functions so that future errors can be
easily detected.

Signed-off-by: Tejun Heo 
Acked-by: Serge E. Hallyn 
Cc: Aristeu Rozanski 
Cc: Li Zefan