lkml.org 
[lkml]   [2014]   [May]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 13/14] device_cgroup: use css_has_online_children() instead of has_children()
    On Fri, May 09, 2014 at 05:31:30PM -0400, Tejun Heo wrote:
    > devcgroup_update_access() wants to know whether there are child
    > cgroups which are online and visible to userland and has_children()
    > may return false positive. Replace it with css_has_online_children().
    >
    > Signed-off-by: Tejun Heo <tj@kernel.org>
    > Cc: Aristeu Rozanski <aris@redhat.com>
    > Cc: Serge Hallyn <serge.hallyn@ubuntu.com>
    > ---
    > security/device_cgroup.c | 19 ++-----------------
    > 1 file changed, 2 insertions(+), 17 deletions(-)
    >
    > diff --git a/security/device_cgroup.c b/security/device_cgroup.c
    > index 75b4b18..22de334 100644
    > --- a/security/device_cgroup.c
    > +++ b/security/device_cgroup.c
    > @@ -475,21 +475,6 @@ static int propagate_exception(struct dev_cgroup *devcg_root,
    > return rc;
    > }
    >
    > -static inline bool has_children(struct dev_cgroup *devcgroup)
    > -{
    > - bool ret;
    > -
    > - /*
    > - * FIXME: There may be lingering offline csses and this function
    > - * may return %true when there isn't any userland-visible child
    > - * which is incorrect for our purposes.
    > - */
    > - rcu_read_lock();
    > - ret = css_next_child(NULL, &devcgroup->css);
    > - rcu_read_unlock();
    > - return ret;
    > -}
    > -
    > /*
    > * Modify the exception list using allow/deny rules.
    > * CAP_SYS_ADMIN is needed for this. It's at least separate from CAP_MKNOD
    > @@ -522,7 +507,7 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
    > case 'a':
    > switch (filetype) {
    > case DEVCG_ALLOW:
    > - if (has_children(devcgroup))
    > + if (css_has_online_children(&devcgroup->css))
    > return -EINVAL;
    >
    > if (!may_allow_all(parent))
    > @@ -538,7 +523,7 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
    > return rc;
    > break;
    > case DEVCG_DENY:
    > - if (has_children(devcgroup))
    > + if (css_has_online_children(&devcgroup->css))
    > return -EINVAL;
    >
    > dev_exception_clean(devcgroup);

    Acked-by: Aristeu Rozanski <aris@redhat.com>

    --
    Aristeu



    \
     
     \ /
      Last update: 2014-05-13 15:41    [W:4.055 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site