Commit-ID: 4d6959cf503a2a7395216f4bb14fb5409468fac9 Gitweb: https://git.kernel.org/tip/4d6959cf503a2a7395216f4bb14fb5409468fac9 Author: Reinette Chatre <reinette.cha...@intel.com> AuthorDate: Tue, 29 May 2018 05:57:42 -0700 Committer: Thomas Gleixner <t...@linutronix.de> CommitDate: Wed, 20 Jun 2018 00:56:33 +0200
x86/intel_rdt: Respect read and write access By default, if the opener has CAP_DAC_OVERRIDE, a kernfs file can be opened regardless of RW permissions. Writing to a kernfs file will thus succeed even if permissions are 0000. It's required to restrict the actions that can be performed on a resource group from userspace based on the mode of the resource group. This restriction will be done through a modification of the file permissions. That is, for example, if a resource group is locked then the user cannot add tasks to the resource group. For this restriction through file permissions to work it has to be ensured that the permissions are always respected. To do so the resctrl filesystem is created with the KERNFS_ROOT_EXTRA_OPEN_PERM_CHECK flag that will result in open(2) failing with -EACCESS regardless of CAP_DAC_OVERRIDE if the permission does not have the respective read or write access. Signed-off-by: Reinette Chatre <reinette.cha...@intel.com> Signed-off-by: Thomas Gleixner <t...@linutronix.de> Cc: fenghua...@intel.com Cc: tony.l...@intel.com Cc: vikas.shiva...@linux.intel.com Cc: gavin.hind...@intel.com Cc: jithu.jos...@intel.com Cc: dave.han...@intel.com Cc: h...@zytor.com Link: https://lkml.kernel.org/r/c8b54235b16f40b74fded417f5b6151afe8f27b1.1527593970.git.reinette.cha...@intel.com --- arch/x86/kernel/cpu/intel_rdt_rdtgroup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c index 9e69f4dbc686..0ddb455b126d 100644 --- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c +++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c @@ -2537,7 +2537,8 @@ static int __init rdtgroup_setup_root(void) int ret; rdt_root = kernfs_create_root(&rdtgroup_kf_syscall_ops, - KERNFS_ROOT_CREATE_DEACTIVATED, + KERNFS_ROOT_CREATE_DEACTIVATED | + KERNFS_ROOT_EXTRA_OPEN_PERM_CHECK, &rdtgroup_default); if (IS_ERR(rdt_root)) return PTR_ERR(rdt_root);
