linux.git/security/device_cgroup.c, branch v2.6.27

devcgroup: fix race against rmdir()

2008-09-03T02:21:38+00:00

During the use of a dev_cgroup, we should guarantee the corresponding
cgroup won't be deleted (i.e.  via rmdir).  This can be done through
css_get(&dev_cgroup->css), but here we can just get and use the dev_cgroup
under rcu_read_lock.

And also remove checking NULL dev_cgroup, it won't be NULL since a task
always belongs to a cgroup.

Signed-off-by: Li Zefan 
Acked-by: Serge Hallyn 
Cc: Paul Menage 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devcgroup: code cleanup

2008-07-25T17:53:37+00:00

- clean up set_majmin()
- use simple_strtoul() to parse major/minor

[akpm@linux-foundation.org: fix simple_strtoul() usage]
[kosaki.motohiro@jp.fujitsu.com: fix warnings]
Signed-off-by: Li Zefan 
Acked-by: Serge Hallyn 
Cc: Serge Hallyn 
Cc: Paul Menage 
Cc: Pavel Emelyanov 
Signed-off-by: KOSAKI Motohiro 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devcgroup: relax white-list protection down to RCU

2008-07-25T17:53:37+00:00

Currently this list is protected with a simple spinlock, even for reading
from one.  This is OK, but can be better.

Actually I want it to be better very much, since after replacing the
OpenVZ device permissions engine with the cgroup-based one I noticed, that
we set 12 default device permissions for each newly created container (for
/dev/null, full, terminals, ect devices), and people sometimes have up to
20 perms more, so traversing the ~30-40 elements list under a spinlock
doesn't seem very good.

Here's the RCU protection for white-list - dev_whitelist_item-s are added
and removed under the devcg->lock, but are looked up in permissions
checking under the rcu_read_lock.

Signed-off-by: Pavel Emelyanov 
Acked-by: Serge Hallyn 
Cc: Balbir Singh 
Cc: Paul Menage 
Cc: "Paul E. McKenney" 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

cgroup files: convert devcgroup_access_write() into a cgroup write_string() handler

2008-07-25T17:53:36+00:00

This patch converts devcgroup_access_write() from a raw file handler
into a handler for the cgroup write_string() method. This allows some
boilerplate copying/locking/checking to be removed and simplifies the
cleanup path, since these functions are performed by the cgroups
framework before calling the handler.

Signed-off-by: Paul Menage 
Cc: Paul Jackson 
Cc: Pavel Emelyanov 
Cc: Balbir Singh 
Acked-by: Serge Hallyn 
Cc: KAMEZAWA Hiroyuki 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devcgroup: fix permission check when adding entry to child cgroup

2008-07-13T19:51:18+00:00

 # cat devices.list
 c 1:3 r
 # echo 'c 1:3 w' > sub/devices.allow
 # cat sub/devices.list
 c 1:3 w

As illustrated, the parent group has no write permission to /dev/null, so
it's child should not be allowed to add this write permission.

Signed-off-by: Li Zefan 
Acked-by: Serge Hallyn 
Cc: Serge Hallyn 
Cc: Paul Menage 
Cc: Pavel Emelyanov 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devcgroup: always show positive major/minor num

2008-07-13T19:51:18+00:00

 # echo "b $((0x7fffffff)):$((0x80000000)) rwm" > devices.allow
 # cat devices.list
 b 214748364:-21474836 rwm

though a major/minor number of 0x800000000 is meaningless, we
should not cast it to a negative value.

Signed-off-by: Li Zefan 
Acked-by: Serge Hallyn 
Cc: Serge Hallyn 
Cc: Paul Menage 
Cc: Pavel Emelyanov 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devcgroup: fix odd behaviour when writing 'a' to devices.allow

2008-07-04T17:40:10+00:00

 # cat /devcg/devices.list
 a *:* rwm
 # echo a > devices.allow
 # cat /devcg/devices.list
 a *:* rwm
 a 0:0 rwm

This is odd and maybe confusing.  With this patch, writing 'a' to
devices.allow will add 'a *:* rwm' to the whitelist.

Also a few fixes and updates to the document.

Signed-off-by: Li Zefan 
Cc: Pavel Emelyanov 
Cc: Serge E. Hallyn 
Cc: Paul Menage 
Cc: Balbir Singh 
Cc: James Morris 
Cc: Chris Wright 
Cc: Stephen Smalley 
Cc: KAMEZAWA Hiroyuki 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devscgroup: make white list more compact in some cases

2008-06-06T18:29:11+00:00

Consider you added a 'c foo:bar r' permission to some cgroup and then (a
bit later) 'c'foo:bar w' for it.  After this you'll see the

c foo:bar r
c foo:bar w

lines in a devices.list file.

Another example - consider you added 10 'c foo:bar r' permissions to some
cgroup (e.g.  by mistake).  After this you'll see 10 c foo:bar r lines in
a list file.

This is weird.  This situation also has one more annoying consequence.
Having many items in a white list makes permissions checking slower, sine
it has to walk a longer list.

The proposal is to merge permissions for items, that correspond to the
same device.

Signed-off-by: Pavel Emelyanov 
Acked-by: Serge Hallyn 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devscgroup: relax task to dev_cgroup conversion

2008-06-06T18:29:11+00:00

Two functions, that need to get a device_cgroup from a task (they are
devcgroup_inode_permission and devcgroup_inode_mknod) make it in a strange
way:

They get a css_set from task, then a subsys_state from css_set, then a
cgroup from the state and then a subsys_state again from the cgroup.
Besides, the devices_subsys_id is read from memory, whilst there's a
enum-ed constant for it.

Optimize this part a bit:
1. Get the subsys_stats form the task and be done - no 2 extra
   dereferences,
2. Use the device_subsys_id constant, not the value from memory
   (i.e. one less dereference).

Found while preparing 2.6.26 OpenVZ port.

Signed-off-by: Pavel Emelyanov 
Acked-by: Serge Hallyn 
Acked-by: Paul Menage 
Cc: Balbir Singh 
Cc: James Morris 
Cc: Chris Wright 
Cc: Stephen Smalley 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devcgroup: make a helper to convert cgroup_subsys_state to devs_cgroup

2008-06-06T18:29:11+00:00

This is just picking the container_of out of cgroup_to_devcgroup into a
separate function.

This new css_to_devcgroup will be used in the 2nd patch.

Signed-off-by: Pavel Emelyanov 
Acked-by: Serge Hallyn 
Cc: Paul Menage 
Cc: Balbir Singh 
Cc: James Morris 
Cc: Chris Wright 
Cc: Stephen Smalley 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds