1 /* 2 * device_cgroup.c - device cgroup subsystem 3 * 4 * Copyright 2007 IBM Corp 5 */ 6 7 #include <linux/device_cgroup.h> 8 #include <linux/cgroup.h> 9 #include <linux/ctype.h> 10 #include <linux/list.h> 11 #include <linux/uaccess.h> 12 #include <linux/seq_file.h> 13 #include <linux/slab.h> 14 #include <linux/rcupdate.h> 15 #include <linux/mutex.h> 16 17 #define ACC_MKNOD 1 18 #define ACC_READ 2 19 #define ACC_WRITE 4 20 #define ACC_MASK (ACC_MKNOD | ACC_READ | ACC_WRITE) 21 22 #define DEV_BLOCK 1 23 #define DEV_CHAR 2 24 #define DEV_ALL 4 /* this represents all devices */ 25 26 static DEFINE_MUTEX(devcgroup_mutex); 27 28 enum devcg_behavior { 29 DEVCG_DEFAULT_NONE, 30 DEVCG_DEFAULT_ALLOW, 31 DEVCG_DEFAULT_DENY, 32 }; 33 34 /* 35 * exception list locking rules: 36 * hold devcgroup_mutex for update/read. 37 * hold rcu_read_lock() for read. 38 */ 39 40 struct dev_exception_item { 41 u32 major, minor; 42 short type; 43 short access; 44 struct list_head list; 45 struct rcu_head rcu; 46 }; 47 48 struct dev_cgroup { 49 struct cgroup_subsys_state css; 50 struct list_head exceptions; 51 enum devcg_behavior behavior; 52 /* temporary list for pending propagation operations */ 53 struct list_head propagate_pending; 54 }; 55 56 static inline struct dev_cgroup *css_to_devcgroup(struct cgroup_subsys_state *s) 57 { 58 return container_of(s, struct dev_cgroup, css); 59 } 60 61 static inline struct dev_cgroup *cgroup_to_devcgroup(struct cgroup *cgroup) 62 { 63 return css_to_devcgroup(cgroup_subsys_state(cgroup, devices_subsys_id)); 64 } 65 66 static inline struct dev_cgroup *task_devcgroup(struct task_struct *task) 67 { 68 return css_to_devcgroup(task_subsys_state(task, devices_subsys_id)); 69 } 70 71 struct cgroup_subsys devices_subsys; 72 73 static int devcgroup_can_attach(struct cgroup *new_cgrp, 74 struct cgroup_taskset *set) 75 { 76 struct task_struct *task = cgroup_taskset_first(set); 77 78 if (current != task && !capable(CAP_SYS_ADMIN)) 79 return -EPERM; 80 return 0; 81 } 82 83 /* 84 * called under devcgroup_mutex 85 */ 86 static int dev_exceptions_copy(struct list_head *dest, struct list_head *orig) 87 { 88 struct dev_exception_item *ex, *tmp, *new; 89 90 lockdep_assert_held(&devcgroup_mutex); 91 92 list_for_each_entry(ex, orig, list) { 93 new = kmemdup(ex, sizeof(*ex), GFP_KERNEL); 94 if (!new) 95 goto free_and_exit; 96 list_add_tail(&new->list, dest); 97 } 98 99 return 0; 100 101 free_and_exit: 102 list_for_each_entry_safe(ex, tmp, dest, list) { 103 list_del(&ex->list); 104 kfree(ex); 105 } 106 return -ENOMEM; 107 } 108 109 /* 110 * called under devcgroup_mutex 111 */ 112 static int dev_exception_add(struct dev_cgroup *dev_cgroup, 113 struct dev_exception_item *ex) 114 { 115 struct dev_exception_item *excopy, *walk; 116 117 lockdep_assert_held(&devcgroup_mutex); 118 119 excopy = kmemdup(ex, sizeof(*ex), GFP_KERNEL); 120 if (!excopy) 121 return -ENOMEM; 122 123 list_for_each_entry(walk, &dev_cgroup->exceptions, list) { 124 if (walk->type != ex->type) 125 continue; 126 if (walk->major != ex->major) 127 continue; 128 if (walk->minor != ex->minor) 129 continue; 130 131 walk->access |= ex->access; 132 kfree(excopy); 133 excopy = NULL; 134 } 135 136 if (excopy != NULL) 137 list_add_tail_rcu(&excopy->list, &dev_cgroup->exceptions); 138 return 0; 139 } 140 141 /* 142 * called under devcgroup_mutex 143 */ 144 static void dev_exception_rm(struct dev_cgroup *dev_cgroup, 145 struct dev_exception_item *ex) 146 { 147 struct dev_exception_item *walk, *tmp; 148 149 lockdep_assert_held(&devcgroup_mutex); 150 151 list_for_each_entry_safe(walk, tmp, &dev_cgroup->exceptions, list) { 152 if (walk->type != ex->type) 153 continue; 154 if (walk->major != ex->major) 155 continue; 156 if (walk->minor != ex->minor) 157 continue; 158 159 walk->access &= ~ex->access; 160 if (!walk->access) { 161 list_del_rcu(&walk->list); 162 kfree_rcu(walk, rcu); 163 } 164 } 165 } 166 167 static void __dev_exception_clean(struct dev_cgroup *dev_cgroup) 168 { 169 struct dev_exception_item *ex, *tmp; 170 171 list_for_each_entry_safe(ex, tmp, &dev_cgroup->exceptions, list) { 172 list_del_rcu(&ex->list); 173 kfree_rcu(ex, rcu); 174 } 175 } 176 177 /** 178 * dev_exception_clean - frees all entries of the exception list 179 * @dev_cgroup: dev_cgroup with the exception list to be cleaned 180 * 181 * called under devcgroup_mutex 182 */ 183 static void dev_exception_clean(struct dev_cgroup *dev_cgroup) 184 { 185 lockdep_assert_held(&devcgroup_mutex); 186 187 __dev_exception_clean(dev_cgroup); 188 } 189 190 static inline bool is_devcg_online(const struct dev_cgroup *devcg) 191 { 192 return (devcg->behavior != DEVCG_DEFAULT_NONE); 193 } 194 195 /** 196 * devcgroup_online - initializes devcgroup's behavior and exceptions based on 197 * parent's 198 * @cgroup: cgroup getting online 199 * returns 0 in case of success, error code otherwise 200 */ 201 static int devcgroup_online(struct cgroup *cgroup) 202 { 203 struct dev_cgroup *dev_cgroup, *parent_dev_cgroup = NULL; 204 int ret = 0; 205 206 mutex_lock(&devcgroup_mutex); 207 dev_cgroup = cgroup_to_devcgroup(cgroup); 208 if (cgroup->parent) 209 parent_dev_cgroup = cgroup_to_devcgroup(cgroup->parent); 210 211 if (parent_dev_cgroup == NULL) 212 dev_cgroup->behavior = DEVCG_DEFAULT_ALLOW; 213 else { 214 ret = dev_exceptions_copy(&dev_cgroup->exceptions, 215 &parent_dev_cgroup->exceptions); 216 if (!ret) 217 dev_cgroup->behavior = parent_dev_cgroup->behavior; 218 } 219 mutex_unlock(&devcgroup_mutex); 220 221 return ret; 222 } 223 224 static void devcgroup_offline(struct cgroup *cgroup) 225 { 226 struct dev_cgroup *dev_cgroup = cgroup_to_devcgroup(cgroup); 227 228 mutex_lock(&devcgroup_mutex); 229 dev_cgroup->behavior = DEVCG_DEFAULT_NONE; 230 mutex_unlock(&devcgroup_mutex); 231 } 232 233 /* 234 * called from kernel/cgroup.c with cgroup_lock() held. 235 */ 236 static struct cgroup_subsys_state *devcgroup_css_alloc(struct cgroup *cgroup) 237 { 238 struct dev_cgroup *dev_cgroup; 239 struct cgroup *parent_cgroup; 240 241 dev_cgroup = kzalloc(sizeof(*dev_cgroup), GFP_KERNEL); 242 if (!dev_cgroup) 243 return ERR_PTR(-ENOMEM); 244 INIT_LIST_HEAD(&dev_cgroup->exceptions); 245 INIT_LIST_HEAD(&dev_cgroup->propagate_pending); 246 dev_cgroup->behavior = DEVCG_DEFAULT_NONE; 247 parent_cgroup = cgroup->parent; 248 249 return &dev_cgroup->css; 250 } 251 252 static void devcgroup_css_free(struct cgroup *cgroup) 253 { 254 struct dev_cgroup *dev_cgroup; 255 256 dev_cgroup = cgroup_to_devcgroup(cgroup); 257 __dev_exception_clean(dev_cgroup); 258 kfree(dev_cgroup); 259 } 260 261 #define DEVCG_ALLOW 1 262 #define DEVCG_DENY 2 263 #define DEVCG_LIST 3 264 265 #define MAJMINLEN 13 266 #define ACCLEN 4 267 268 static void set_access(char *acc, short access) 269 { 270 int idx = 0; 271 memset(acc, 0, ACCLEN); 272 if (access & ACC_READ) 273 acc[idx++] = 'r'; 274 if (access & ACC_WRITE) 275 acc[idx++] = 'w'; 276 if (access & ACC_MKNOD) 277 acc[idx++] = 'm'; 278 } 279 280 static char type_to_char(short type) 281 { 282 if (type == DEV_ALL) 283 return 'a'; 284 if (type == DEV_CHAR) 285 return 'c'; 286 if (type == DEV_BLOCK) 287 return 'b'; 288 return 'X'; 289 } 290 291 static void set_majmin(char *str, unsigned m) 292 { 293 if (m == ~0) 294 strcpy(str, "*"); 295 else 296 sprintf(str, "%u", m); 297 } 298 299 static int devcgroup_seq_read(struct cgroup *cgroup, struct cftype *cft, 300 struct seq_file *m) 301 { 302 struct dev_cgroup *devcgroup = cgroup_to_devcgroup(cgroup); 303 struct dev_exception_item *ex; 304 char maj[MAJMINLEN], min[MAJMINLEN], acc[ACCLEN]; 305 306 rcu_read_lock(); 307 /* 308 * To preserve the compatibility: 309 * - Only show the "all devices" when the default policy is to allow 310 * - List the exceptions in case the default policy is to deny 311 * This way, the file remains as a "whitelist of devices" 312 */ 313 if (devcgroup->behavior == DEVCG_DEFAULT_ALLOW) { 314 set_access(acc, ACC_MASK); 315 set_majmin(maj, ~0); 316 set_majmin(min, ~0); 317 seq_printf(m, "%c %s:%s %s\n", type_to_char(DEV_ALL), 318 maj, min, acc); 319 } else { 320 list_for_each_entry_rcu(ex, &devcgroup->exceptions, list) { 321 set_access(acc, ex->access); 322 set_majmin(maj, ex->major); 323 set_majmin(min, ex->minor); 324 seq_printf(m, "%c %s:%s %s\n", type_to_char(ex->type), 325 maj, min, acc); 326 } 327 } 328 rcu_read_unlock(); 329 330 return 0; 331 } 332 333 /** 334 * may_access - verifies if a new exception is part of what is allowed 335 * by a dev cgroup based on the default policy + 336 * exceptions. This is used to make sure a child cgroup 337 * won't have more privileges than its parent or to 338 * verify if a certain access is allowed. 339 * @dev_cgroup: dev cgroup to be tested against 340 * @refex: new exception 341 * @behavior: behavior of the exception 342 */ 343 static bool may_access(struct dev_cgroup *dev_cgroup, 344 struct dev_exception_item *refex, 345 enum devcg_behavior behavior) 346 { 347 struct dev_exception_item *ex; 348 bool match = false; 349 350 rcu_lockdep_assert(rcu_read_lock_held() || 351 lockdep_is_held(&devcgroup_mutex), 352 "device_cgroup::may_access() called without proper synchronization"); 353 354 list_for_each_entry_rcu(ex, &dev_cgroup->exceptions, list) { 355 if ((refex->type & DEV_BLOCK) && !(ex->type & DEV_BLOCK)) 356 continue; 357 if ((refex->type & DEV_CHAR) && !(ex->type & DEV_CHAR)) 358 continue; 359 if (ex->major != ~0 && ex->major != refex->major) 360 continue; 361 if (ex->minor != ~0 && ex->minor != refex->minor) 362 continue; 363 if (refex->access & (~ex->access)) 364 continue; 365 match = true; 366 break; 367 } 368 369 if (dev_cgroup->behavior == DEVCG_DEFAULT_ALLOW) { 370 if (behavior == DEVCG_DEFAULT_ALLOW) { 371 /* the exception will deny access to certain devices */ 372 return true; 373 } else { 374 /* the exception will allow access to certain devices */ 375 if (match) 376 /* 377 * a new exception allowing access shouldn't 378 * match an parent's exception 379 */ 380 return false; 381 return true; 382 } 383 } else { 384 /* only behavior == DEVCG_DEFAULT_DENY allowed here */ 385 if (match) 386 /* parent has an exception that matches the proposed */ 387 return true; 388 else 389 return false; 390 } 391 return false; 392 } 393 394 /* 395 * parent_has_perm: 396 * when adding a new allow rule to a device exception list, the rule 397 * must be allowed in the parent device 398 */ 399 static int parent_has_perm(struct dev_cgroup *childcg, 400 struct dev_exception_item *ex) 401 { 402 struct cgroup *pcg = childcg->css.cgroup->parent; 403 struct dev_cgroup *parent; 404 405 if (!pcg) 406 return 1; 407 parent = cgroup_to_devcgroup(pcg); 408 return may_access(parent, ex, childcg->behavior); 409 } 410 411 /** 412 * may_allow_all - checks if it's possible to change the behavior to 413 * allow based on parent's rules. 414 * @parent: device cgroup's parent 415 * returns: != 0 in case it's allowed, 0 otherwise 416 */ 417 static inline int may_allow_all(struct dev_cgroup *parent) 418 { 419 if (!parent) 420 return 1; 421 return parent->behavior == DEVCG_DEFAULT_ALLOW; 422 } 423 424 /** 425 * revalidate_active_exceptions - walks through the active exception list and 426 * revalidates the exceptions based on parent's 427 * behavior and exceptions. The exceptions that 428 * are no longer valid will be removed. 429 * Called with devcgroup_mutex held. 430 * @devcg: cgroup which exceptions will be checked 431 * 432 * This is one of the three key functions for hierarchy implementation. 433 * This function is responsible for re-evaluating all the cgroup's active 434 * exceptions due to a parent's exception change. 435 * Refer to Documentation/cgroups/devices.txt for more details. 436 */ 437 static void revalidate_active_exceptions(struct dev_cgroup *devcg) 438 { 439 struct dev_exception_item *ex; 440 struct list_head *this, *tmp; 441 442 list_for_each_safe(this, tmp, &devcg->exceptions) { 443 ex = container_of(this, struct dev_exception_item, list); 444 if (!parent_has_perm(devcg, ex)) 445 dev_exception_rm(devcg, ex); 446 } 447 } 448 449 /** 450 * get_online_devcg - walks the cgroup tree and fills a list with the online 451 * groups 452 * @root: cgroup used as starting point 453 * @online: list that will be filled with online groups 454 * 455 * Must be called with devcgroup_mutex held. Grabs RCU lock. 456 * Because devcgroup_mutex is held, no devcg will become online or offline 457 * during the tree walk (see devcgroup_online, devcgroup_offline) 458 * A separated list is needed because propagate_behavior() and 459 * propagate_exception() need to allocate memory and can block. 460 */ 461 static void get_online_devcg(struct cgroup *root, struct list_head *online) 462 { 463 struct cgroup *pos; 464 struct dev_cgroup *devcg; 465 466 lockdep_assert_held(&devcgroup_mutex); 467 468 rcu_read_lock(); 469 cgroup_for_each_descendant_pre(pos, root) { 470 devcg = cgroup_to_devcgroup(pos); 471 if (is_devcg_online(devcg)) 472 list_add_tail(&devcg->propagate_pending, online); 473 } 474 rcu_read_unlock(); 475 } 476 477 /** 478 * propagate_exception - propagates a new exception to the children 479 * @devcg_root: device cgroup that added a new exception 480 * @ex: new exception to be propagated 481 * 482 * returns: 0 in case of success, != 0 in case of error 483 */ 484 static int propagate_exception(struct dev_cgroup *devcg_root, 485 struct dev_exception_item *ex) 486 { 487 struct cgroup *root = devcg_root->css.cgroup; 488 struct dev_cgroup *devcg, *parent, *tmp; 489 int rc = 0; 490 LIST_HEAD(pending); 491 492 get_online_devcg(root, &pending); 493 494 list_for_each_entry_safe(devcg, tmp, &pending, propagate_pending) { 495 parent = cgroup_to_devcgroup(devcg->css.cgroup->parent); 496 497 /* 498 * in case both root's behavior and devcg is allow, a new 499 * restriction means adding to the exception list 500 */ 501 if (devcg_root->behavior == DEVCG_DEFAULT_ALLOW && 502 devcg->behavior == DEVCG_DEFAULT_ALLOW) { 503 rc = dev_exception_add(devcg, ex); 504 if (rc) 505 break; 506 } else { 507 /* 508 * in the other possible cases: 509 * root's behavior: allow, devcg's: deny 510 * root's behavior: deny, devcg's: deny 511 * the exception will be removed 512 */ 513 dev_exception_rm(devcg, ex); 514 } 515 revalidate_active_exceptions(devcg); 516 517 list_del_init(&devcg->propagate_pending); 518 } 519 return rc; 520 } 521 522 static inline bool has_children(struct dev_cgroup *devcgroup) 523 { 524 struct cgroup *cgrp = devcgroup->css.cgroup; 525 526 return !list_empty(&cgrp->children); 527 } 528 529 /* 530 * Modify the exception list using allow/deny rules. 531 * CAP_SYS_ADMIN is needed for this. It's at least separate from CAP_MKNOD 532 * so we can give a container CAP_MKNOD to let it create devices but not 533 * modify the exception list. 534 * It seems likely we'll want to add a CAP_CONTAINER capability to allow 535 * us to also grant CAP_SYS_ADMIN to containers without giving away the 536 * device exception list controls, but for now we'll stick with CAP_SYS_ADMIN 537 * 538 * Taking rules away is always allowed (given CAP_SYS_ADMIN). Granting 539 * new access is only allowed if you're in the top-level cgroup, or your 540 * parent cgroup has the access you're asking for. 541 */ 542 static int devcgroup_update_access(struct dev_cgroup *devcgroup, 543 int filetype, const char *buffer) 544 { 545 const char *b; 546 char temp[12]; /* 11 + 1 characters needed for a u32 */ 547 int count, rc = 0; 548 struct dev_exception_item ex; 549 struct cgroup *p = devcgroup->css.cgroup; 550 struct dev_cgroup *parent = NULL; 551 552 if (!capable(CAP_SYS_ADMIN)) 553 return -EPERM; 554 555 if (p->parent) 556 parent = cgroup_to_devcgroup(p->parent); 557 558 memset(&ex, 0, sizeof(ex)); 559 b = buffer; 560 561 switch (*b) { 562 case 'a': 563 switch (filetype) { 564 case DEVCG_ALLOW: 565 if (has_children(devcgroup)) 566 return -EINVAL; 567 568 if (!may_allow_all(parent)) 569 return -EPERM; 570 dev_exception_clean(devcgroup); 571 devcgroup->behavior = DEVCG_DEFAULT_ALLOW; 572 if (!parent) 573 break; 574 575 rc = dev_exceptions_copy(&devcgroup->exceptions, 576 &parent->exceptions); 577 if (rc) 578 return rc; 579 break; 580 case DEVCG_DENY: 581 if (has_children(devcgroup)) 582 return -EINVAL; 583 584 dev_exception_clean(devcgroup); 585 devcgroup->behavior = DEVCG_DEFAULT_DENY; 586 break; 587 default: 588 return -EINVAL; 589 } 590 return 0; 591 case 'b': 592 ex.type = DEV_BLOCK; 593 break; 594 case 'c': 595 ex.type = DEV_CHAR; 596 break; 597 default: 598 return -EINVAL; 599 } 600 b++; 601 if (!isspace(*b)) 602 return -EINVAL; 603 b++; 604 if (*b == '*') { 605 ex.major = ~0; 606 b++; 607 } else if (isdigit(*b)) { 608 memset(temp, 0, sizeof(temp)); 609 for (count = 0; count < sizeof(temp) - 1; count++) { 610 temp[count] = *b; 611 b++; 612 if (!isdigit(*b)) 613 break; 614 } 615 rc = kstrtou32(temp, 10, &ex.major); 616 if (rc) 617 return -EINVAL; 618 } else { 619 return -EINVAL; 620 } 621 if (*b != ':') 622 return -EINVAL; 623 b++; 624 625 /* read minor */ 626 if (*b == '*') { 627 ex.minor = ~0; 628 b++; 629 } else if (isdigit(*b)) { 630 memset(temp, 0, sizeof(temp)); 631 for (count = 0; count < sizeof(temp) - 1; count++) { 632 temp[count] = *b; 633 b++; 634 if (!isdigit(*b)) 635 break; 636 } 637 rc = kstrtou32(temp, 10, &ex.minor); 638 if (rc) 639 return -EINVAL; 640 } else { 641 return -EINVAL; 642 } 643 if (!isspace(*b)) 644 return -EINVAL; 645 for (b++, count = 0; count < 3; count++, b++) { 646 switch (*b) { 647 case 'r': 648 ex.access |= ACC_READ; 649 break; 650 case 'w': 651 ex.access |= ACC_WRITE; 652 break; 653 case 'm': 654 ex.access |= ACC_MKNOD; 655 break; 656 case '\n': 657 case '\0': 658 count = 3; 659 break; 660 default: 661 return -EINVAL; 662 } 663 } 664 665 switch (filetype) { 666 case DEVCG_ALLOW: 667 if (!parent_has_perm(devcgroup, &ex)) 668 return -EPERM; 669 /* 670 * If the default policy is to allow by default, try to remove 671 * an matching exception instead. And be silent about it: we 672 * don't want to break compatibility 673 */ 674 if (devcgroup->behavior == DEVCG_DEFAULT_ALLOW) { 675 dev_exception_rm(devcgroup, &ex); 676 return 0; 677 } 678 rc = dev_exception_add(devcgroup, &ex); 679 break; 680 case DEVCG_DENY: 681 /* 682 * If the default policy is to deny by default, try to remove 683 * an matching exception instead. And be silent about it: we 684 * don't want to break compatibility 685 */ 686 if (devcgroup->behavior == DEVCG_DEFAULT_DENY) 687 dev_exception_rm(devcgroup, &ex); 688 else 689 rc = dev_exception_add(devcgroup, &ex); 690 691 if (rc) 692 break; 693 /* we only propagate new restrictions */ 694 rc = propagate_exception(devcgroup, &ex); 695 break; 696 default: 697 rc = -EINVAL; 698 } 699 return rc; 700 } 701 702 static int devcgroup_access_write(struct cgroup *cgrp, struct cftype *cft, 703 const char *buffer) 704 { 705 int retval; 706 707 mutex_lock(&devcgroup_mutex); 708 retval = devcgroup_update_access(cgroup_to_devcgroup(cgrp), 709 cft->private, buffer); 710 mutex_unlock(&devcgroup_mutex); 711 return retval; 712 } 713 714 static struct cftype dev_cgroup_files[] = { 715 { 716 .name = "allow", 717 .write_string = devcgroup_access_write, 718 .private = DEVCG_ALLOW, 719 }, 720 { 721 .name = "deny", 722 .write_string = devcgroup_access_write, 723 .private = DEVCG_DENY, 724 }, 725 { 726 .name = "list", 727 .read_seq_string = devcgroup_seq_read, 728 .private = DEVCG_LIST, 729 }, 730 { } /* terminate */ 731 }; 732 733 struct cgroup_subsys devices_subsys = { 734 .name = "devices", 735 .can_attach = devcgroup_can_attach, 736 .css_alloc = devcgroup_css_alloc, 737 .css_free = devcgroup_css_free, 738 .css_online = devcgroup_online, 739 .css_offline = devcgroup_offline, 740 .subsys_id = devices_subsys_id, 741 .base_cftypes = dev_cgroup_files, 742 }; 743 744 /** 745 * __devcgroup_check_permission - checks if an inode operation is permitted 746 * @dev_cgroup: the dev cgroup to be tested against 747 * @type: device type 748 * @major: device major number 749 * @minor: device minor number 750 * @access: combination of ACC_WRITE, ACC_READ and ACC_MKNOD 751 * 752 * returns 0 on success, -EPERM case the operation is not permitted 753 */ 754 static int __devcgroup_check_permission(short type, u32 major, u32 minor, 755 short access) 756 { 757 struct dev_cgroup *dev_cgroup; 758 struct dev_exception_item ex; 759 int rc; 760 761 memset(&ex, 0, sizeof(ex)); 762 ex.type = type; 763 ex.major = major; 764 ex.minor = minor; 765 ex.access = access; 766 767 rcu_read_lock(); 768 dev_cgroup = task_devcgroup(current); 769 rc = may_access(dev_cgroup, &ex, dev_cgroup->behavior); 770 rcu_read_unlock(); 771 772 if (!rc) 773 return -EPERM; 774 775 return 0; 776 } 777 778 int __devcgroup_inode_permission(struct inode *inode, int mask) 779 { 780 short type, access = 0; 781 782 if (S_ISBLK(inode->i_mode)) 783 type = DEV_BLOCK; 784 if (S_ISCHR(inode->i_mode)) 785 type = DEV_CHAR; 786 if (mask & MAY_WRITE) 787 access |= ACC_WRITE; 788 if (mask & MAY_READ) 789 access |= ACC_READ; 790 791 return __devcgroup_check_permission(type, imajor(inode), iminor(inode), 792 access); 793 } 794 795 int devcgroup_inode_mknod(int mode, dev_t dev) 796 { 797 short type; 798 799 if (!S_ISBLK(mode) && !S_ISCHR(mode)) 800 return 0; 801 802 if (S_ISBLK(mode)) 803 type = DEV_BLOCK; 804 else 805 type = DEV_CHAR; 806 807 return __devcgroup_check_permission(type, MAJOR(dev), MINOR(dev), 808 ACC_MKNOD); 809 810 } 811