linux.git/security/device_cgroup.c, branch v2.6.31

devcgroup: skip superfluous checks when found the DEV_ALL elem

2009-06-18T20:03:47+00:00

While walking through the whitelist, if the DEV_ALL item is found, no more
check is needed.

Signed-off-by: Li Zefan 
Acked-by: Serge Hallyn 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devcgroup: avoid using cgroup_lock

2009-04-03T02:04:55+00:00

There is nothing special that has to be protected by cgroup_lock,
so introduce devcgroup_mtuex for it's own use.

Signed-off-by: Li Zefan 
Cc: Paul Menage 
Acked-by: Serge Hallyn 
Cc: Balbir Singh 
Cc: KAMEZAWA Hiroyuki 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devices cgroup: allow mkfifo

2009-01-08T16:31:03+00:00

The devcgroup_inode_permission() hook in the devices whitelist cgroup has
always bypassed access checks on fifos.  But the mknod hook did not.  The
devices whitelist is only about block and char devices, and fifos can't
even be added to the whitelist, so fifos can't be created at all except by
tasks which have 'a' in their whitelist (meaning they have access to all
devices).

Fix the behavior by bypassing access checks to mkfifo.

Signed-off-by: Serge E. Hallyn 
Cc: Li Zefan 
Cc: Pavel Emelyanov 
Cc: Paul Menage 
Cc: Lai Jiangshan 
Cc: KOSAKI Motohiro 
Cc: James Morris 
Reported-by: Daniel Lezcano 
Cc: 		[2.6.27.x]
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devcgroup: use list_for_each_entry_rcu()

2009-01-08T16:31:03+00:00

We should use list_for_each_entry_rcu in RCU read site.

Signed-off-by: Lai Jiangshan 
Cc: Paul Menage 
Cc: KAMEZAWA Hiroyuki 
Cc: Pavel Emelyanov 
Cc: Balbir Singh 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devcgroup: remove spin_lock()

2008-10-20T15:52:38+00:00

Since we introduced rcu for read side, spin_lock is used only for update.
But we always hold cgroup_lock() when update, so spin_lock() is not need.

Additional cleanup:
1) include linux/rcupdate.h explicitly
2) remove unused variable cur_devcgroup in devcgroup_update_access()

Signed-off-by: Lai Jiangshan 
Acked-by: "Serge E. Hallyn" 
Cc: Paul Menage 
Cc: James Morris 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devcgroup: remove unused variable

2008-10-20T15:52:38+00:00

Signed-off-by: Li Zefan 
Acked-by: Serge Hallyn 
Cc: Paul Menage 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devcgroup: use kmemdup()

2008-10-20T15:52:38+00:00

This saves 40 bytes on my x86_32 box.

Signed-off-by: Li Zefan 
Acked-by: Serge Hallyn 
Cc: Paul Menage 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devcgroup: fix race against rmdir()

2008-09-03T02:21:38+00:00

During the use of a dev_cgroup, we should guarantee the corresponding
cgroup won't be deleted (i.e.  via rmdir).  This can be done through
css_get(&dev_cgroup->css), but here we can just get and use the dev_cgroup
under rcu_read_lock.

And also remove checking NULL dev_cgroup, it won't be NULL since a task
always belongs to a cgroup.

Signed-off-by: Li Zefan 
Acked-by: Serge Hallyn 
Cc: Paul Menage 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devcgroup: code cleanup

2008-07-25T17:53:37+00:00

- clean up set_majmin()
- use simple_strtoul() to parse major/minor

[akpm@linux-foundation.org: fix simple_strtoul() usage]
[kosaki.motohiro@jp.fujitsu.com: fix warnings]
Signed-off-by: Li Zefan 
Acked-by: Serge Hallyn 
Cc: Serge Hallyn 
Cc: Paul Menage 
Cc: Pavel Emelyanov 
Signed-off-by: KOSAKI Motohiro 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

devcgroup: relax white-list protection down to RCU

2008-07-25T17:53:37+00:00

Currently this list is protected with a simple spinlock, even for reading
from one.  This is OK, but can be better.

Actually I want it to be better very much, since after replacing the
OpenVZ device permissions engine with the cgroup-based one I noticed, that
we set 12 default device permissions for each newly created container (for
/dev/null, full, terminals, ect devices), and people sometimes have up to
20 perms more, so traversing the ~30-40 elements list under a spinlock
doesn't seem very good.

Here's the RCU protection for white-list - dev_whitelist_item-s are added
and removed under the devcg->lock, but are looked up in permissions
checking under the rcu_read_lock.

Signed-off-by: Pavel Emelyanov 
Acked-by: Serge Hallyn 
Cc: Balbir Singh 
Cc: Paul Menage 
Cc: "Paul E. McKenney" 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds