Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7db9cfd3 authored by Pavel Emelyanov's avatar Pavel Emelyanov Committed by Linus Torvalds
Browse files

devscgroup: check for device permissions at mount time 



Currently even if a task sits in an all-denied cgroup it can still mount
any block device in any mode it wants.

Put a proper check in do_open for block device to prevent this.

Signed-off-by: default avatarPavel Emelyanov <xemul@openvz.org>
Acked-by: default avatarSerge Hallyn <serue@us.ibm.com>
Tested-by: default avatarSerge Hallyn <serue@us.ibm.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent cc9cb219

fs/block_dev.c

+7 −1
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ 
#include <linux/kmod.h>

#include <linux/major.h>

#include <linux/smp_lock.h>

#include <linux/device_cgroup.h>

#include <linux/highmem.h>

#include <linux/blkdev.h>

#include <linux/module.h>
@@ -928,9 +929,14 @@ static int do_open(struct block_device *bdev, struct file *file, int for_part) 
{

	struct module *owner = NULL;

	struct gendisk *disk;

	int ret = -ENXIO;

	int ret;

	int part;



	ret = devcgroup_inode_permission(bdev->bd_inode, file->f_mode);

	if (ret != 0)

		return ret;



	ret = -ENXIO;

	file->f_mapping = bdev->bd_inode->i_mapping;

	lock_kernel();

	disk = get_gendisk(bdev->bd_dev, &part);