Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d823f6bf authored by Li Zefan's avatar Li Zefan Committed by Linus Torvalds
Browse files

devcgroup: fix odd behaviour when writing 'a' to devices.allow 



 # cat /devcg/devices.list
 a *:* rwm
 # echo a > devices.allow
 # cat /devcg/devices.list
 a *:* rwm
 a 0:0 rwm

This is odd and maybe confusing.  With this patch, writing 'a' to
devices.allow will add 'a *:* rwm' to the whitelist.

Also a few fixes and updates to the document.

Signed-off-by: default avatarLi Zefan <lizf@cn.fujitsu.com>
Cc: Pavel Emelyanov <xemul@openvz.org>
Cc: Serge E. Hallyn <serue@us.ibm.com>
Cc: Paul Menage <menage@google.com>
Cc: Balbir Singh <balbir@in.ibm.com>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 26ff8c69

Documentation/controllers/devices.txt

+6 −2
Original line number Diff line number Diff line
@@ -13,7 +13,7 @@ either an integer or * for all. Access is a composition of r 
The root device cgroup starts with rwm to 'all'.  A child device

cgroup gets a copy of the parent.  Administrators can then remove

devices from the whitelist or add new entries.  A child cgroup can

never receive a device access which is denied its parent.  However

never receive a device access which is denied by its parent.  However

when a device access is removed from a parent it will not also be

removed from the child(ren).
@@ -29,7 +29,11 @@ allows cgroup 1 to read and mknod the device usually known as 


	echo a > /cgroups/1/devices.deny



will remove the default 'a *:* mrw' entry.

will remove the default 'a *:* rwm' entry. Doing



	echo a > /cgroups/1/devices.allow



will add the 'a *:* rwm' entry to the whitelist.



3. Security

security/device_cgroup.c

+2 −0
Original line number Diff line number Diff line
@@ -382,6 +382,8 @@ static ssize_t devcgroup_access_write(struct cgroup *cgroup, struct cftype *cft, 
	case 'a':

		wh.type = DEV_ALL;

		wh.access = ACC_MASK;

		wh.major = ~0;

		wh.minor = ~0;

		goto handle;

	case 'b':

		wh.type = DEV_BLOCK;