Messages in this thread Patch in this message | | | Date | Tue, 08 Jul 2008 09:51:09 +0800 | From | Li Zefan <> | Subject | [PATCH 2/3] devcgroup: fix permission check when adding entry to child cgroup |
| |
# cat devices.list c 1:3 r # echo 'c 1:3 w' > sub/devices.allow # cat sub/devices.list c 1:3 w
As illustrated, the parent group has no write permission to /dev/null, so it's child should not be allowed to add this write permission.
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com> Acked-by: Serge Hallyn <serue@us.ibm.com> --- security/device_cgroup.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/security/device_cgroup.c b/security/device_cgroup.c index 1e2e28a..ddd92ce 100644 --- a/security/device_cgroup.c +++ b/security/device_cgroup.c @@ -300,7 +300,7 @@ static int may_access_whitelist(struct dev_cgroup *c, continue; if (whitem->minor != ~0 && whitem->minor != refwh->minor) continue; - if (refwh->access & (~(whitem->access | ACC_MASK))) + if (refwh->access & (~whitem->access)) continue; return 1; } -- 1.5.4.rc3
| |