Messages in this thread | | | Date | Thu, 5 Jun 2008 10:49:57 -0500 | From | "Serge E. Hallyn" <> | Subject | Re: [PATCH 1/2] devscgroup: check for device permissions at mount time |
| |
Quoting Pavel Emelyanov (xemul@openvz.org): > Currently even if a task sits in an all-denied cgroup it can still > mount any block device in any mode it wants. > > Put a proper check in do_open for block device to prevent this. > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Crud. Tested and confirmed, and this patches fixes it.
Acked-by: Serge Hallyn <serue@us.ibm.com> Tested-by: Serge Hallyn <serue@us.ibm.com>
thanks, -serge
> --- > fs/block_dev.c | 8 +++++++- > 1 files changed, 7 insertions(+), 1 deletions(-) > > diff --git a/fs/block_dev.c b/fs/block_dev.c > index a0e9596..7e1c7a3 100644 > --- a/fs/block_dev.c > +++ b/fs/block_dev.c > @@ -24,6 +24,7 @@ > #include <linux/namei.h> > #include <linux/log2.h> > #include <linux/hardirq.h> > +#include <linux/device_cgroup.h> > > #include <asm/uaccess.h> > #include "internal.h" > @@ -933,9 +934,14 @@ static int do_open(struct block_device *bdev, struct file *file, int for_part) > { > struct module *owner = NULL; > struct gendisk *disk; > - int ret = -ENXIO; > + int ret; > int part; > > + ret = devcgroup_inode_permission(bdev->bd_inode, file->f_mode); > + if (ret != 0) > + return ret; > + > + ret = -ENXIO; > file->f_mapping = bdev->bd_inode->i_mapping; > lock_kernel(); > disk = get_gendisk(bdev->bd_dev, &part); > -- > 1.5.3.4
| |