devcgroup: fix odd behaviour when writing 'a' to devices.allow (d823f6bf) · Commits · 戴 / test

# cat /devcg/devices.list a *:* rwm # echo a > devices.allow # cat /devcg/devices.list a *:* rwm a 0:0 rwm This is odd and maybe confusing. With this patch, writing 'a' to devices.allow will add 'a *:* rwm' to the whitelist. Also a few fixes and updates to the document. Signed-off-by:

Li Zefan <lizf@cn.fujitsu.com> Cc: Pavel Emelyanov <xemul@openvz.org> Cc: Serge E. Hallyn <serue@us.ibm.com> Cc: Paul Menage <menage@google.com> Cc: Balbir Singh <balbir@in.ibm.com> Cc: James Morris <jmorris@namei.org> Cc: Chris Wright <chrisw@sous-sol.org> Cc: Stephen Smalley <sds@tycho.nsa.gov> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Signed-off-by:

Andrew Morton <akpm@linux-foundation.org> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

Documentation/controllers/devices.txt

+6 −2

Original line number	Diff line number	Diff line
		@@ -13,7 +13,7 @@ either an integer or * for all. Access is a composition of r
		The root device cgroup starts with rwm to 'all'. A child device
		cgroup gets a copy of the parent. Administrators can then remove
		devices from the whitelist or add new entries. A child cgroup can
		never receive a device access which is denied its parent. However
		never receive a device access which is denied by its parent. However
		when a device access is removed from a parent it will not also be
		removed from the child(ren).

		@@ -29,7 +29,11 @@ allows cgroup 1 to read and mknod the device usually known as

		echo a > /cgroups/1/devices.deny

		will remove the default 'a : mrw' entry.
		will remove the default 'a : rwm' entry. Doing

		echo a > /cgroups/1/devices.allow

		will add the 'a : rwm' entry to the whitelist.

		3. Security

security/device_cgroup.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -382,6 +382,8 @@ static ssize_t devcgroup_access_write(struct cgroup cgroup, struct cftype cft,
		case 'a':
		wh.type = DEV_ALL;
		wh.access = ACC_MASK;
		wh.major = ~0;
		wh.minor = ~0;
		goto handle;
		case 'b':
		wh.type = DEV_BLOCK;

Admin message