mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-25 12:04:46 +08:00
device_cgroup: Roll back to original exceptions after copy failure
commite68bfbd3b3
upstream. When add the 'a *:* rwm' entry to devcgroup A's whitelist, at first A's exceptions will be cleaned and A's behavior is changed to DEVCG_DEFAULT_ALLOW. Then parent's exceptions will be copyed to A's whitelist. If copy failure occurs, just return leaving A to grant permissions to all devices. And A may grant more permissions than parent. Backup A's whitelist and recover original exceptions after copy failure. Cc: stable@vger.kernel.org Fixes:4cef7299b4
("device_cgroup: add proper checking when changing default behavior") Signed-off-by: Wang Weiyang <wangweiyang2@huawei.com> Reviewed-by: Aristeu Rozanski <aris@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
ac838c663b
commit
317ebe61a6
@ -81,6 +81,17 @@ free_and_exit:
|
|||||||
return -ENOMEM;
|
return -ENOMEM;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static void dev_exceptions_move(struct list_head *dest, struct list_head *orig)
|
||||||
|
{
|
||||||
|
struct dev_exception_item *ex, *tmp;
|
||||||
|
|
||||||
|
lockdep_assert_held(&devcgroup_mutex);
|
||||||
|
|
||||||
|
list_for_each_entry_safe(ex, tmp, orig, list) {
|
||||||
|
list_move_tail(&ex->list, dest);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* called under devcgroup_mutex
|
* called under devcgroup_mutex
|
||||||
*/
|
*/
|
||||||
@ -603,11 +614,13 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
|
|||||||
int count, rc = 0;
|
int count, rc = 0;
|
||||||
struct dev_exception_item ex;
|
struct dev_exception_item ex;
|
||||||
struct dev_cgroup *parent = css_to_devcgroup(devcgroup->css.parent);
|
struct dev_cgroup *parent = css_to_devcgroup(devcgroup->css.parent);
|
||||||
|
struct dev_cgroup tmp_devcgrp;
|
||||||
|
|
||||||
if (!capable(CAP_SYS_ADMIN))
|
if (!capable(CAP_SYS_ADMIN))
|
||||||
return -EPERM;
|
return -EPERM;
|
||||||
|
|
||||||
memset(&ex, 0, sizeof(ex));
|
memset(&ex, 0, sizeof(ex));
|
||||||
|
memset(&tmp_devcgrp, 0, sizeof(tmp_devcgrp));
|
||||||
b = buffer;
|
b = buffer;
|
||||||
|
|
||||||
switch (*b) {
|
switch (*b) {
|
||||||
@ -619,15 +632,27 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
|
|||||||
|
|
||||||
if (!may_allow_all(parent))
|
if (!may_allow_all(parent))
|
||||||
return -EPERM;
|
return -EPERM;
|
||||||
dev_exception_clean(devcgroup);
|
if (!parent) {
|
||||||
devcgroup->behavior = DEVCG_DEFAULT_ALLOW;
|
devcgroup->behavior = DEVCG_DEFAULT_ALLOW;
|
||||||
if (!parent)
|
dev_exception_clean(devcgroup);
|
||||||
break;
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
rc = dev_exceptions_copy(&devcgroup->exceptions,
|
INIT_LIST_HEAD(&tmp_devcgrp.exceptions);
|
||||||
&parent->exceptions);
|
rc = dev_exceptions_copy(&tmp_devcgrp.exceptions,
|
||||||
|
&devcgroup->exceptions);
|
||||||
if (rc)
|
if (rc)
|
||||||
return rc;
|
return rc;
|
||||||
|
dev_exception_clean(devcgroup);
|
||||||
|
rc = dev_exceptions_copy(&devcgroup->exceptions,
|
||||||
|
&parent->exceptions);
|
||||||
|
if (rc) {
|
||||||
|
dev_exceptions_move(&devcgroup->exceptions,
|
||||||
|
&tmp_devcgrp.exceptions);
|
||||||
|
return rc;
|
||||||
|
}
|
||||||
|
devcgroup->behavior = DEVCG_DEFAULT_ALLOW;
|
||||||
|
dev_exception_clean(&tmp_devcgrp);
|
||||||
break;
|
break;
|
||||||
case DEVCG_DENY:
|
case DEVCG_DENY:
|
||||||
if (css_has_online_children(&devcgroup->css))
|
if (css_has_online_children(&devcgroup->css))
|
||||||
|
Loading…
Reference in New Issue
Block a user