The commit is pushed to "branch-rh7-3.10.0-123.1.2-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git after rh7-3.10.0-123.1.2.vz7.5.1 ------> commit bc411f061cc8878edb65db52b8e58ab2fa218186 Author: Cyrill Gorcunov <gorcu...@odin.com> Date: Tue May 19 00:43:32 2015 +0400
ve: device cgroup -- Implement devcgroup_seq_show_ve In PCS7 cgroups are configured from user space, so there is no longer connection from ve to device cgroup via css as it was in PCS6. Instead we should open device cgroup explicitly. https://jira.sw.ru/browse/PSBM-33555 v2 (by vdavydov@): - use ve::ve_name because we're switching to UUID based containers Signed-off-by: Cyrill Gorcunov <gorcu...@odin.com> Reviewed-by: Vladimir Davydov <vdavy...@parallels.com> CC: Konstantin Khorenko <khore...@odin.com> CC: Andrey Vagin <ava...@odin.com> --- include/linux/device_cgroup.h | 3 ++- kernel/ve/vecalls.c | 2 +- security/device_cgroup.c | 14 +++++++++++--- 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/include/linux/device_cgroup.h b/include/linux/device_cgroup.h index bc58c4c..32588bb 100644 --- a/include/linux/device_cgroup.h +++ b/include/linux/device_cgroup.h @@ -19,7 +19,8 @@ extern int devcgroup_device_visible(umode_t mode, int major, struct cgroup; int devcgroup_default_perms_ve(struct cgroup *cgroup); int devcgroup_set_perms_ve(struct cgroup *cgroup, unsigned, dev_t, unsigned); -int devcgroup_seq_show_ve(struct cgroup *cgroup, unsigned veid, struct seq_file *m); +struct ve_struct; +int devcgroup_seq_show_ve(struct cgroup *devices_root, struct ve_struct *ve, struct seq_file *m); #else static inline int devcgroup_inode_permission(struct inode *inode, int mask) diff --git a/kernel/ve/vecalls.c b/kernel/ve/vecalls.c index 7c574b3..2613a1e 100644 --- a/kernel/ve/vecalls.c +++ b/kernel/ve/vecalls.c @@ -891,7 +891,7 @@ static int devperms_seq_show(struct seq_file *m, void *v) if (ve_is_super(ve)) seq_printf(m, "%10u b 016 *:*\n%10u c 006 *:*\n", 0, 0); else - devcgroup_seq_show_ve(ve->css.cgroup, ve->veid, m); + devcgroup_seq_show_ve(devices_root, ve, m); return 0; } diff --git a/security/device_cgroup.c b/security/device_cgroup.c index 31024f7..33a9883 100644 --- a/security/device_cgroup.c +++ b/security/device_cgroup.c @@ -17,6 +17,7 @@ #include <linux/major.h> #include <linux/module.h> #include <linux/capability.h> +#include <linux/ve.h> #define ACC_MKNOD 1 #define ACC_READ 2 @@ -1091,10 +1092,16 @@ int devcgroup_set_perms_ve(struct cgroup *cgroup, } EXPORT_SYMBOL(devcgroup_set_perms_ve); -int devcgroup_seq_show_ve(struct cgroup *cgroup, unsigned veid, struct seq_file *m) +int devcgroup_seq_show_ve(struct cgroup *devices_root, struct ve_struct *ve, struct seq_file *m) { - struct dev_cgroup *devcgroup = cgroup_to_devcgroup(cgroup); struct dev_exception_item *wh; + struct dev_cgroup *devcgroup; + struct cgroup *cgroup; + + cgroup = cgroup_kernel_open(devices_root, 0, ve_name(ve)); + if (IS_ERR(cgroup)) + return PTR_ERR(cgroup); + devcgroup = cgroup_to_devcgroup(cgroup); rcu_read_lock(); list_for_each_entry_rcu(wh, &devcgroup->exceptions, list) { @@ -1112,12 +1119,13 @@ int devcgroup_seq_show_ve(struct cgroup *cgroup, unsigned veid, struct seq_file perm |= S_IXOTH; seq_printf(m, "%10u %c %03o %s:%s\n", - veid, + ve->veid, type_to_char(wh->type), perm, maj, min); } rcu_read_unlock(); + cgroup_kernel_close(cgroup); return 0; } EXPORT_SYMBOL(devcgroup_seq_show_ve); _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel