1 /* 2 * device_cgroup.c - device cgroup subsystem 3 * 4 * Copyright 2007 IBM Corp 5 */ 6 7 #include <linux/device_cgroup.h> 8 #include <linux/cgroup.h> 9 #include <linux/ctype.h> 10 #include <linux/list.h> 11 #include <linux/uaccess.h> 12 #include <linux/seq_file.h> 13 #include <linux/slab.h> 14 #include <linux/rcupdate.h> 15 #include <linux/mutex.h> 16 17 #define ACC_MKNOD 1 18 #define ACC_READ 2 19 #define ACC_WRITE 4 20 #define ACC_MASK (ACC_MKNOD | ACC_READ | ACC_WRITE) 21 22 #define DEV_BLOCK 1 23 #define DEV_CHAR 2 24 #define DEV_ALL 4 /* this represents all devices */ 25 26 static DEFINE_MUTEX(devcgroup_mutex); 27 28 /* 29 * whitelist locking rules: 30 * hold devcgroup_mutex for update/read. 31 * hold rcu_read_lock() for read. 32 */ 33 34 struct dev_whitelist_item { 35 u32 major, minor; 36 short type; 37 short access; 38 struct list_head list; 39 struct rcu_head rcu; 40 }; 41 42 struct dev_cgroup { 43 struct cgroup_subsys_state css; 44 struct list_head whitelist; 45 }; 46 47 static inline struct dev_cgroup *css_to_devcgroup(struct cgroup_subsys_state *s) 48 { 49 return container_of(s, struct dev_cgroup, css); 50 } 51 52 static inline struct dev_cgroup *cgroup_to_devcgroup(struct cgroup *cgroup) 53 { 54 return css_to_devcgroup(cgroup_subsys_state(cgroup, devices_subsys_id)); 55 } 56 57 static inline struct dev_cgroup *task_devcgroup(struct task_struct *task) 58 { 59 return css_to_devcgroup(task_subsys_state(task, devices_subsys_id)); 60 } 61 62 struct cgroup_subsys devices_subsys; 63 64 static int devcgroup_can_attach(struct cgroup_subsys *ss, 65 struct cgroup *new_cgroup, struct task_struct *task) 66 { 67 if (current != task && !capable(CAP_SYS_ADMIN)) 68 return -EPERM; 69 70 return 0; 71 } 72 73 /* 74 * called under devcgroup_mutex 75 */ 76 static int dev_whitelist_copy(struct list_head *dest, struct list_head *orig) 77 { 78 struct dev_whitelist_item *wh, *tmp, *new; 79 80 list_for_each_entry(wh, orig, list) { 81 new = kmemdup(wh, sizeof(*wh), GFP_KERNEL); 82 if (!new) 83 goto free_and_exit; 84 list_add_tail(&new->list, dest); 85 } 86 87 return 0; 88 89 free_and_exit: 90 list_for_each_entry_safe(wh, tmp, dest, list) { 91 list_del(&wh->list); 92 kfree(wh); 93 } 94 return -ENOMEM; 95 } 96 97 /* Stupid prototype - don't bother combining existing entries */ 98 /* 99 * called under devcgroup_mutex 100 */ 101 static int dev_whitelist_add(struct dev_cgroup *dev_cgroup, 102 struct dev_whitelist_item *wh) 103 { 104 struct dev_whitelist_item *whcopy, *walk; 105 106 whcopy = kmemdup(wh, sizeof(*wh), GFP_KERNEL); 107 if (!whcopy) 108 return -ENOMEM; 109 110 list_for_each_entry(walk, &dev_cgroup->whitelist, list) { 111 if (walk->type != wh->type) 112 continue; 113 if (walk->major != wh->major) 114 continue; 115 if (walk->minor != wh->minor) 116 continue; 117 118 walk->access |= wh->access; 119 kfree(whcopy); 120 whcopy = NULL; 121 } 122 123 if (whcopy != NULL) 124 list_add_tail_rcu(&whcopy->list, &dev_cgroup->whitelist); 125 return 0; 126 } 127 128 /* 129 * called under devcgroup_mutex 130 */ 131 static void dev_whitelist_rm(struct dev_cgroup *dev_cgroup, 132 struct dev_whitelist_item *wh) 133 { 134 struct dev_whitelist_item *walk, *tmp; 135 136 list_for_each_entry_safe(walk, tmp, &dev_cgroup->whitelist, list) { 137 if (walk->type == DEV_ALL) 138 goto remove; 139 if (walk->type != wh->type) 140 continue; 141 if (walk->major != ~0 && walk->major != wh->major) 142 continue; 143 if (walk->minor != ~0 && walk->minor != wh->minor) 144 continue; 145 146 remove: 147 walk->access &= ~wh->access; 148 if (!walk->access) { 149 list_del_rcu(&walk->list); 150 kfree_rcu(walk, rcu); 151 } 152 } 153 } 154 155 /* 156 * called from kernel/cgroup.c with cgroup_lock() held. 157 */ 158 static struct cgroup_subsys_state *devcgroup_create(struct cgroup_subsys *ss, 159 struct cgroup *cgroup) 160 { 161 struct dev_cgroup *dev_cgroup, *parent_dev_cgroup; 162 struct cgroup *parent_cgroup; 163 int ret; 164 165 dev_cgroup = kzalloc(sizeof(*dev_cgroup), GFP_KERNEL); 166 if (!dev_cgroup) 167 return ERR_PTR(-ENOMEM); 168 INIT_LIST_HEAD(&dev_cgroup->whitelist); 169 parent_cgroup = cgroup->parent; 170 171 if (parent_cgroup == NULL) { 172 struct dev_whitelist_item *wh; 173 wh = kmalloc(sizeof(*wh), GFP_KERNEL); 174 if (!wh) { 175 kfree(dev_cgroup); 176 return ERR_PTR(-ENOMEM); 177 } 178 wh->minor = wh->major = ~0; 179 wh->type = DEV_ALL; 180 wh->access = ACC_MASK; 181 list_add(&wh->list, &dev_cgroup->whitelist); 182 } else { 183 parent_dev_cgroup = cgroup_to_devcgroup(parent_cgroup); 184 mutex_lock(&devcgroup_mutex); 185 ret = dev_whitelist_copy(&dev_cgroup->whitelist, 186 &parent_dev_cgroup->whitelist); 187 mutex_unlock(&devcgroup_mutex); 188 if (ret) { 189 kfree(dev_cgroup); 190 return ERR_PTR(ret); 191 } 192 } 193 194 return &dev_cgroup->css; 195 } 196 197 static void devcgroup_destroy(struct cgroup_subsys *ss, 198 struct cgroup *cgroup) 199 { 200 struct dev_cgroup *dev_cgroup; 201 struct dev_whitelist_item *wh, *tmp; 202 203 dev_cgroup = cgroup_to_devcgroup(cgroup); 204 list_for_each_entry_safe(wh, tmp, &dev_cgroup->whitelist, list) { 205 list_del(&wh->list); 206 kfree(wh); 207 } 208 kfree(dev_cgroup); 209 } 210 211 #define DEVCG_ALLOW 1 212 #define DEVCG_DENY 2 213 #define DEVCG_LIST 3 214 215 #define MAJMINLEN 13 216 #define ACCLEN 4 217 218 static void set_access(char *acc, short access) 219 { 220 int idx = 0; 221 memset(acc, 0, ACCLEN); 222 if (access & ACC_READ) 223 acc[idx++] = 'r'; 224 if (access & ACC_WRITE) 225 acc[idx++] = 'w'; 226 if (access & ACC_MKNOD) 227 acc[idx++] = 'm'; 228 } 229 230 static char type_to_char(short type) 231 { 232 if (type == DEV_ALL) 233 return 'a'; 234 if (type == DEV_CHAR) 235 return 'c'; 236 if (type == DEV_BLOCK) 237 return 'b'; 238 return 'X'; 239 } 240 241 static void set_majmin(char *str, unsigned m) 242 { 243 if (m == ~0) 244 strcpy(str, "*"); 245 else 246 sprintf(str, "%u", m); 247 } 248 249 static int devcgroup_seq_read(struct cgroup *cgroup, struct cftype *cft, 250 struct seq_file *m) 251 { 252 struct dev_cgroup *devcgroup = cgroup_to_devcgroup(cgroup); 253 struct dev_whitelist_item *wh; 254 char maj[MAJMINLEN], min[MAJMINLEN], acc[ACCLEN]; 255 256 rcu_read_lock(); 257 list_for_each_entry_rcu(wh, &devcgroup->whitelist, list) { 258 set_access(acc, wh->access); 259 set_majmin(maj, wh->major); 260 set_majmin(min, wh->minor); 261 seq_printf(m, "%c %s:%s %s\n", type_to_char(wh->type), 262 maj, min, acc); 263 } 264 rcu_read_unlock(); 265 266 return 0; 267 } 268 269 /* 270 * may_access_whitelist: 271 * does the access granted to dev_cgroup c contain the access 272 * requested in whitelist item refwh. 273 * return 1 if yes, 0 if no. 274 * call with devcgroup_mutex held 275 */ 276 static int may_access_whitelist(struct dev_cgroup *c, 277 struct dev_whitelist_item *refwh) 278 { 279 struct dev_whitelist_item *whitem; 280 281 list_for_each_entry(whitem, &c->whitelist, list) { 282 if (whitem->type & DEV_ALL) 283 return 1; 284 if ((refwh->type & DEV_BLOCK) && !(whitem->type & DEV_BLOCK)) 285 continue; 286 if ((refwh->type & DEV_CHAR) && !(whitem->type & DEV_CHAR)) 287 continue; 288 if (whitem->major != ~0 && whitem->major != refwh->major) 289 continue; 290 if (whitem->minor != ~0 && whitem->minor != refwh->minor) 291 continue; 292 if (refwh->access & (~whitem->access)) 293 continue; 294 return 1; 295 } 296 return 0; 297 } 298 299 /* 300 * parent_has_perm: 301 * when adding a new allow rule to a device whitelist, the rule 302 * must be allowed in the parent device 303 */ 304 static int parent_has_perm(struct dev_cgroup *childcg, 305 struct dev_whitelist_item *wh) 306 { 307 struct cgroup *pcg = childcg->css.cgroup->parent; 308 struct dev_cgroup *parent; 309 310 if (!pcg) 311 return 1; 312 parent = cgroup_to_devcgroup(pcg); 313 return may_access_whitelist(parent, wh); 314 } 315 316 /* 317 * Modify the whitelist using allow/deny rules. 318 * CAP_SYS_ADMIN is needed for this. It's at least separate from CAP_MKNOD 319 * so we can give a container CAP_MKNOD to let it create devices but not 320 * modify the whitelist. 321 * It seems likely we'll want to add a CAP_CONTAINER capability to allow 322 * us to also grant CAP_SYS_ADMIN to containers without giving away the 323 * device whitelist controls, but for now we'll stick with CAP_SYS_ADMIN 324 * 325 * Taking rules away is always allowed (given CAP_SYS_ADMIN). Granting 326 * new access is only allowed if you're in the top-level cgroup, or your 327 * parent cgroup has the access you're asking for. 328 */ 329 static int devcgroup_update_access(struct dev_cgroup *devcgroup, 330 int filetype, const char *buffer) 331 { 332 const char *b; 333 char *endp; 334 int count; 335 struct dev_whitelist_item wh; 336 337 if (!capable(CAP_SYS_ADMIN)) 338 return -EPERM; 339 340 memset(&wh, 0, sizeof(wh)); 341 b = buffer; 342 343 switch (*b) { 344 case 'a': 345 wh.type = DEV_ALL; 346 wh.access = ACC_MASK; 347 wh.major = ~0; 348 wh.minor = ~0; 349 goto handle; 350 case 'b': 351 wh.type = DEV_BLOCK; 352 break; 353 case 'c': 354 wh.type = DEV_CHAR; 355 break; 356 default: 357 return -EINVAL; 358 } 359 b++; 360 if (!isspace(*b)) 361 return -EINVAL; 362 b++; 363 if (*b == '*') { 364 wh.major = ~0; 365 b++; 366 } else if (isdigit(*b)) { 367 wh.major = simple_strtoul(b, &endp, 10); 368 b = endp; 369 } else { 370 return -EINVAL; 371 } 372 if (*b != ':') 373 return -EINVAL; 374 b++; 375 376 /* read minor */ 377 if (*b == '*') { 378 wh.minor = ~0; 379 b++; 380 } else if (isdigit(*b)) { 381 wh.minor = simple_strtoul(b, &endp, 10); 382 b = endp; 383 } else { 384 return -EINVAL; 385 } 386 if (!isspace(*b)) 387 return -EINVAL; 388 for (b++, count = 0; count < 3; count++, b++) { 389 switch (*b) { 390 case 'r': 391 wh.access |= ACC_READ; 392 break; 393 case 'w': 394 wh.access |= ACC_WRITE; 395 break; 396 case 'm': 397 wh.access |= ACC_MKNOD; 398 break; 399 case '\n': 400 case '\0': 401 count = 3; 402 break; 403 default: 404 return -EINVAL; 405 } 406 } 407 408 handle: 409 switch (filetype) { 410 case DEVCG_ALLOW: 411 if (!parent_has_perm(devcgroup, &wh)) 412 return -EPERM; 413 return dev_whitelist_add(devcgroup, &wh); 414 case DEVCG_DENY: 415 dev_whitelist_rm(devcgroup, &wh); 416 break; 417 default: 418 return -EINVAL; 419 } 420 return 0; 421 } 422 423 static int devcgroup_access_write(struct cgroup *cgrp, struct cftype *cft, 424 const char *buffer) 425 { 426 int retval; 427 428 mutex_lock(&devcgroup_mutex); 429 retval = devcgroup_update_access(cgroup_to_devcgroup(cgrp), 430 cft->private, buffer); 431 mutex_unlock(&devcgroup_mutex); 432 return retval; 433 } 434 435 static struct cftype dev_cgroup_files[] = { 436 { 437 .name = "allow", 438 .write_string = devcgroup_access_write, 439 .private = DEVCG_ALLOW, 440 }, 441 { 442 .name = "deny", 443 .write_string = devcgroup_access_write, 444 .private = DEVCG_DENY, 445 }, 446 { 447 .name = "list", 448 .read_seq_string = devcgroup_seq_read, 449 .private = DEVCG_LIST, 450 }, 451 }; 452 453 static int devcgroup_populate(struct cgroup_subsys *ss, 454 struct cgroup *cgroup) 455 { 456 return cgroup_add_files(cgroup, ss, dev_cgroup_files, 457 ARRAY_SIZE(dev_cgroup_files)); 458 } 459 460 struct cgroup_subsys devices_subsys = { 461 .name = "devices", 462 .can_attach = devcgroup_can_attach, 463 .create = devcgroup_create, 464 .destroy = devcgroup_destroy, 465 .populate = devcgroup_populate, 466 .subsys_id = devices_subsys_id, 467 }; 468 469 int __devcgroup_inode_permission(struct inode *inode, int mask) 470 { 471 struct dev_cgroup *dev_cgroup; 472 struct dev_whitelist_item *wh; 473 474 rcu_read_lock(); 475 476 dev_cgroup = task_devcgroup(current); 477 478 list_for_each_entry_rcu(wh, &dev_cgroup->whitelist, list) { 479 if (wh->type & DEV_ALL) 480 goto found; 481 if ((wh->type & DEV_BLOCK) && !S_ISBLK(inode->i_mode)) 482 continue; 483 if ((wh->type & DEV_CHAR) && !S_ISCHR(inode->i_mode)) 484 continue; 485 if (wh->major != ~0 && wh->major != imajor(inode)) 486 continue; 487 if (wh->minor != ~0 && wh->minor != iminor(inode)) 488 continue; 489 490 if ((mask & MAY_WRITE) && !(wh->access & ACC_WRITE)) 491 continue; 492 if ((mask & MAY_READ) && !(wh->access & ACC_READ)) 493 continue; 494 found: 495 rcu_read_unlock(); 496 return 0; 497 } 498 499 rcu_read_unlock(); 500 501 return -EPERM; 502 } 503 504 int devcgroup_inode_mknod(int mode, dev_t dev) 505 { 506 struct dev_cgroup *dev_cgroup; 507 struct dev_whitelist_item *wh; 508 509 if (!S_ISBLK(mode) && !S_ISCHR(mode)) 510 return 0; 511 512 rcu_read_lock(); 513 514 dev_cgroup = task_devcgroup(current); 515 516 list_for_each_entry_rcu(wh, &dev_cgroup->whitelist, list) { 517 if (wh->type & DEV_ALL) 518 goto found; 519 if ((wh->type & DEV_BLOCK) && !S_ISBLK(mode)) 520 continue; 521 if ((wh->type & DEV_CHAR) && !S_ISCHR(mode)) 522 continue; 523 if (wh->major != ~0 && wh->major != MAJOR(dev)) 524 continue; 525 if (wh->minor != ~0 && wh->minor != MINOR(dev)) 526 continue; 527 528 if (!(wh->access & ACC_MKNOD)) 529 continue; 530 found: 531 rcu_read_unlock(); 532 return 0; 533 } 534 535 rcu_read_unlock(); 536 537 return -EPERM; 538 } 539