Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5b7aa7d5 authored by Aristeu Rozanski's avatar Aristeu Rozanski Committed by Linus Torvalds
Browse files

device_cgroup: rename deny_all to behavior 



This was done in a v2 patch but v1 ended up being committed.  The
variable name is less confusing and stores the default behavior when no
matching exception exists.

Signed-off-by: default avatarAristeu Rozanski <aris@redhat.com>
Cc: Dave Jones <davej@redhat.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Li Zefan <lizefan@huawei.com>
Cc: James Morris <jmorris@namei.org>
Cc: Pavel Emelyanov <xemul@openvz.org>
Acked-by: default avatarSerge Hallyn <serge.hallyn@canonical.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 8c9506d1

security/device_cgroup.c

+14 −11
Original line number Original line Diff line number Diff line
@@ -42,7 +42,10 @@ struct dev_exception_item { 
struct dev_cgroup {

struct dev_cgroup {

	struct cgroup_subsys_state css;

	struct cgroup_subsys_state css;

	struct list_head exceptions;

	struct list_head exceptions;

	bool deny_all;

	enum {

		DEVCG_DEFAULT_ALLOW,

		DEVCG_DEFAULT_DENY,

	} behavior;

};

};





static inline struct dev_cgroup *css_to_devcgroup(struct cgroup_subsys_state *s)

static inline struct dev_cgroup *css_to_devcgroup(struct cgroup_subsys_state *s)
@@ -182,13 +185,13 @@ static struct cgroup_subsys_state *devcgroup_create(struct cgroup *cgroup) 
	parent_cgroup = cgroup->parent;

	parent_cgroup = cgroup->parent;





	if (parent_cgroup == NULL)

	if (parent_cgroup == NULL)

		dev_cgroup->deny_all = false;

		dev_cgroup->behavior = DEVCG_DEFAULT_ALLOW;

	else {

	else {

		parent_dev_cgroup = cgroup_to_devcgroup(parent_cgroup);

		parent_dev_cgroup = cgroup_to_devcgroup(parent_cgroup);

		mutex_lock(&devcgroup_mutex);

		mutex_lock(&devcgroup_mutex);

		ret = dev_exceptions_copy(&dev_cgroup->exceptions,

		ret = dev_exceptions_copy(&dev_cgroup->exceptions,

					  &parent_dev_cgroup->exceptions);

					  &parent_dev_cgroup->exceptions);

		dev_cgroup->deny_all = parent_dev_cgroup->deny_all;

		dev_cgroup->behavior = parent_dev_cgroup->behavior;

		mutex_unlock(&devcgroup_mutex);

		mutex_unlock(&devcgroup_mutex);

		if (ret) {

		if (ret) {

			kfree(dev_cgroup);

			kfree(dev_cgroup);
@@ -260,7 +263,7 @@ static int devcgroup_seq_read(struct cgroup *cgroup, struct cftype *cft, 
	 * - List the exceptions in case the default policy is to deny

	 * - List the exceptions in case the default policy is to deny

	 * This way, the file remains as a "whitelist of devices"

	 * This way, the file remains as a "whitelist of devices"

	 */

	 */

	if (devcgroup->deny_all == false) {

	if (devcgroup->behavior == DEVCG_DEFAULT_ALLOW) {

		set_access(acc, ACC_MASK);

		set_access(acc, ACC_MASK);

		set_majmin(maj, ~0);

		set_majmin(maj, ~0);

		set_majmin(min, ~0);

		set_majmin(min, ~0);
@@ -314,12 +317,12 @@ static int may_access(struct dev_cgroup *dev_cgroup, 
	 * In two cases we'll consider this new exception valid:

	 * In two cases we'll consider this new exception valid:

	 * - the dev cgroup has its default policy to allow + exception list:

	 * - the dev cgroup has its default policy to allow + exception list:

	 *   the new exception should *not* match any of the exceptions

	 *   the new exception should *not* match any of the exceptions

	 *   (!deny_all, !match)

	 *   (behavior == DEVCG_DEFAULT_ALLOW, !match)

	 * - the dev cgroup has its default policy to deny + exception list:

	 * - the dev cgroup has its default policy to deny + exception list:

	 *   the new exception *should* match the exceptions

	 *   the new exception *should* match the exceptions

	 *   (deny_all, match)

	 *   (behavior == DEVCG_DEFAULT_DENY, match)

	 */

	 */

	if (dev_cgroup->deny_all == match)

	if ((dev_cgroup->behavior == DEVCG_DEFAULT_DENY) == match)

		return 1;

		return 1;

	return 0;

	return 0;

}

}
@@ -375,11 +378,11 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup, 
			if (!parent_has_perm(devcgroup, &ex))

			if (!parent_has_perm(devcgroup, &ex))

				return -EPERM;

				return -EPERM;

			dev_exception_clean(devcgroup);

			dev_exception_clean(devcgroup);

			devcgroup->deny_all = false;

			devcgroup->behavior = DEVCG_DEFAULT_ALLOW;

			break;

			break;

		case DEVCG_DENY:

		case DEVCG_DENY:

			dev_exception_clean(devcgroup);

			dev_exception_clean(devcgroup);

			devcgroup->deny_all = true;

			devcgroup->behavior = DEVCG_DEFAULT_DENY;

			break;

			break;

		default:

		default:

			return -EINVAL;

			return -EINVAL;
@@ -452,7 +455,7 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup, 
		 * an matching exception instead. And be silent about it: we

		 * an matching exception instead. And be silent about it: we

		 * don't want to break compatibility

		 * don't want to break compatibility

		 */

		 */

		if (devcgroup->deny_all == false) {

		if (devcgroup->behavior == DEVCG_DEFAULT_ALLOW) {

			dev_exception_rm(devcgroup, &ex);

			dev_exception_rm(devcgroup, &ex);

			return 0;

			return 0;

		}

		}
@@ -463,7 +466,7 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup, 
		 * an matching exception instead. And be silent about it: we

		 * an matching exception instead. And be silent about it: we

		 * don't want to break compatibility

		 * don't want to break compatibility

		 */

		 */

		if (devcgroup->deny_all == true) {

		if (devcgroup->behavior == DEVCG_DEFAULT_DENY) {

			dev_exception_rm(devcgroup, &ex);

			dev_exception_rm(devcgroup, &ex);

			return 0;

			return 0;

		}

		}