Quoting Aristeu Rozanski ([email protected]): > behavior will determine if the default policy is to deny all device access > unless for the ones in the exception list. > > This variable will be used in the next patches to convert device_cgroup > internally into a default policy + rules. > > v2: > - renamed deny_all to behavior > > Cc: Tejun Heo <[email protected]> > Cc: Li Zefan <[email protected]> > Cc: James Morris <[email protected]> > Cc: Pavel Emelyanov <[email protected]> > Cc: Serge Hallyn <[email protected]>
Acked-by: Serge Hallyn <[email protected]> > Signed-off-by: Aristeu Rozanski <[email protected]> > > --- > security/device_cgroup.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > Index: github/security/device_cgroup.c > =================================================================== > --- github.orig/security/device_cgroup.c 2012-08-21 09:49:38.698415513 > -0400 > +++ github/security/device_cgroup.c 2012-08-21 10:50:34.650810797 -0400 > @@ -42,6 +42,10 @@ > struct dev_cgroup { > struct cgroup_subsys_state css; > struct list_head whitelist; > + enum { > + DEVCG_DEFAULT_ALLOW, > + DEVCG_DEFAULT_DENY, > + } behavior; > }; > > static inline struct dev_cgroup *css_to_devcgroup(struct cgroup_subsys_state > *s) > @@ -178,12 +182,14 @@ > wh->minor = wh->major = ~0; > wh->type = DEV_ALL; > wh->access = ACC_MASK; > + dev_cgroup->behavior = DEVCG_DEFAULT_ALLOW; > list_add(&wh->list, &dev_cgroup->whitelist); > } else { > parent_dev_cgroup = cgroup_to_devcgroup(parent_cgroup); > mutex_lock(&devcgroup_mutex); > ret = dev_whitelist_copy(&dev_cgroup->whitelist, > &parent_dev_cgroup->whitelist); > + dev_cgroup->behavior = parent_dev_cgroup->behavior; > mutex_unlock(&devcgroup_mutex); > if (ret) { > kfree(dev_cgroup); > @@ -409,9 +415,11 @@ > case DEVCG_ALLOW: > if (!parent_has_perm(devcgroup, &wh)) > return -EPERM; > + devcgroup->behavior = DEVCG_DEFAULT_ALLOW; > return dev_whitelist_add(devcgroup, &wh); > case DEVCG_DENY: > dev_whitelist_rm(devcgroup, &wh); > + devcgroup->behavior = DEVCG_DEFAULT_DENY; > break; > default: > return -EINVAL; > > -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to [email protected] > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
