1 /* 2 * device_cgroup.c - device cgroup subsystem 3 * 4 * Copyright 2007 IBM Corp 5 */ 6 7 #include <linux/device_cgroup.h> 8 #include <linux/cgroup.h> 9 #include <linux/ctype.h> 10 #include <linux/list.h> 11 #include <linux/uaccess.h> 12 #include <linux/seq_file.h> 13 #include <linux/slab.h> 14 #include <linux/rcupdate.h> 15 #include <linux/mutex.h> 16 17 #define ACC_MKNOD 1 18 #define ACC_READ 2 19 #define ACC_WRITE 4 20 #define ACC_MASK (ACC_MKNOD | ACC_READ | ACC_WRITE) 21 22 #define DEV_BLOCK 1 23 #define DEV_CHAR 2 24 #define DEV_ALL 4 /* this represents all devices */ 25 26 static DEFINE_MUTEX(devcgroup_mutex); 27 28 /* 29 * whitelist locking rules: 30 * hold devcgroup_mutex for update/read. 31 * hold rcu_read_lock() for read. 32 */ 33 34 struct dev_whitelist_item { 35 u32 major, minor; 36 short type; 37 short access; 38 struct list_head list; 39 struct rcu_head rcu; 40 }; 41 42 struct dev_cgroup { 43 struct cgroup_subsys_state css; 44 struct list_head whitelist; 45 }; 46 47 static inline struct dev_cgroup *css_to_devcgroup(struct cgroup_subsys_state *s) 48 { 49 return container_of(s, struct dev_cgroup, css); 50 } 51 52 static inline struct dev_cgroup *cgroup_to_devcgroup(struct cgroup *cgroup) 53 { 54 return css_to_devcgroup(cgroup_subsys_state(cgroup, devices_subsys_id)); 55 } 56 57 static inline struct dev_cgroup *task_devcgroup(struct task_struct *task) 58 { 59 return css_to_devcgroup(task_subsys_state(task, devices_subsys_id)); 60 } 61 62 struct cgroup_subsys devices_subsys; 63 64 static int devcgroup_can_attach(struct cgroup *new_cgrp, 65 struct cgroup_taskset *set) 66 { 67 struct task_struct *task = cgroup_taskset_first(set); 68 69 if (current != task && !capable(CAP_SYS_ADMIN)) 70 return -EPERM; 71 return 0; 72 } 73 74 /* 75 * called under devcgroup_mutex 76 */ 77 static int dev_whitelist_copy(struct list_head *dest, struct list_head *orig) 78 { 79 struct dev_whitelist_item *wh, *tmp, *new; 80 81 list_for_each_entry(wh, orig, list) { 82 new = kmemdup(wh, sizeof(*wh), GFP_KERNEL); 83 if (!new) 84 goto free_and_exit; 85 list_add_tail(&new->list, dest); 86 } 87 88 return 0; 89 90 free_and_exit: 91 list_for_each_entry_safe(wh, tmp, dest, list) { 92 list_del(&wh->list); 93 kfree(wh); 94 } 95 return -ENOMEM; 96 } 97 98 /* Stupid prototype - don't bother combining existing entries */ 99 /* 100 * called under devcgroup_mutex 101 */ 102 static int dev_whitelist_add(struct dev_cgroup *dev_cgroup, 103 struct dev_whitelist_item *wh) 104 { 105 struct dev_whitelist_item *whcopy, *walk; 106 107 whcopy = kmemdup(wh, sizeof(*wh), GFP_KERNEL); 108 if (!whcopy) 109 return -ENOMEM; 110 111 list_for_each_entry(walk, &dev_cgroup->whitelist, list) { 112 if (walk->type != wh->type) 113 continue; 114 if (walk->major != wh->major) 115 continue; 116 if (walk->minor != wh->minor) 117 continue; 118 119 walk->access |= wh->access; 120 kfree(whcopy); 121 whcopy = NULL; 122 } 123 124 if (whcopy != NULL) 125 list_add_tail_rcu(&whcopy->list, &dev_cgroup->whitelist); 126 return 0; 127 } 128 129 /* 130 * called under devcgroup_mutex 131 */ 132 static void dev_whitelist_rm(struct dev_cgroup *dev_cgroup, 133 struct dev_whitelist_item *wh) 134 { 135 struct dev_whitelist_item *walk, *tmp; 136 137 list_for_each_entry_safe(walk, tmp, &dev_cgroup->whitelist, list) { 138 if (walk->type == DEV_ALL) 139 goto remove; 140 if (walk->type != wh->type) 141 continue; 142 if (walk->major != ~0 && walk->major != wh->major) 143 continue; 144 if (walk->minor != ~0 && walk->minor != wh->minor) 145 continue; 146 147 remove: 148 walk->access &= ~wh->access; 149 if (!walk->access) { 150 list_del_rcu(&walk->list); 151 kfree_rcu(walk, rcu); 152 } 153 } 154 } 155 156 /* 157 * called from kernel/cgroup.c with cgroup_lock() held. 158 */ 159 static struct cgroup_subsys_state *devcgroup_create(struct cgroup *cgroup) 160 { 161 struct dev_cgroup *dev_cgroup, *parent_dev_cgroup; 162 struct cgroup *parent_cgroup; 163 int ret; 164 165 dev_cgroup = kzalloc(sizeof(*dev_cgroup), GFP_KERNEL); 166 if (!dev_cgroup) 167 return ERR_PTR(-ENOMEM); 168 INIT_LIST_HEAD(&dev_cgroup->whitelist); 169 parent_cgroup = cgroup->parent; 170 171 if (parent_cgroup == NULL) { 172 struct dev_whitelist_item *wh; 173 wh = kmalloc(sizeof(*wh), GFP_KERNEL); 174 if (!wh) { 175 kfree(dev_cgroup); 176 return ERR_PTR(-ENOMEM); 177 } 178 wh->minor = wh->major = ~0; 179 wh->type = DEV_ALL; 180 wh->access = ACC_MASK; 181 list_add(&wh->list, &dev_cgroup->whitelist); 182 } else { 183 parent_dev_cgroup = cgroup_to_devcgroup(parent_cgroup); 184 mutex_lock(&devcgroup_mutex); 185 ret = dev_whitelist_copy(&dev_cgroup->whitelist, 186 &parent_dev_cgroup->whitelist); 187 mutex_unlock(&devcgroup_mutex); 188 if (ret) { 189 kfree(dev_cgroup); 190 return ERR_PTR(ret); 191 } 192 } 193 194 return &dev_cgroup->css; 195 } 196 197 static void devcgroup_destroy(struct cgroup *cgroup) 198 { 199 struct dev_cgroup *dev_cgroup; 200 struct dev_whitelist_item *wh, *tmp; 201 202 dev_cgroup = cgroup_to_devcgroup(cgroup); 203 list_for_each_entry_safe(wh, tmp, &dev_cgroup->whitelist, list) { 204 list_del(&wh->list); 205 kfree(wh); 206 } 207 kfree(dev_cgroup); 208 } 209 210 #define DEVCG_ALLOW 1 211 #define DEVCG_DENY 2 212 #define DEVCG_LIST 3 213 214 #define MAJMINLEN 13 215 #define ACCLEN 4 216 217 static void set_access(char *acc, short access) 218 { 219 int idx = 0; 220 memset(acc, 0, ACCLEN); 221 if (access & ACC_READ) 222 acc[idx++] = 'r'; 223 if (access & ACC_WRITE) 224 acc[idx++] = 'w'; 225 if (access & ACC_MKNOD) 226 acc[idx++] = 'm'; 227 } 228 229 static char type_to_char(short type) 230 { 231 if (type == DEV_ALL) 232 return 'a'; 233 if (type == DEV_CHAR) 234 return 'c'; 235 if (type == DEV_BLOCK) 236 return 'b'; 237 return 'X'; 238 } 239 240 static void set_majmin(char *str, unsigned m) 241 { 242 if (m == ~0) 243 strcpy(str, "*"); 244 else 245 sprintf(str, "%u", m); 246 } 247 248 static int devcgroup_seq_read(struct cgroup *cgroup, struct cftype *cft, 249 struct seq_file *m) 250 { 251 struct dev_cgroup *devcgroup = cgroup_to_devcgroup(cgroup); 252 struct dev_whitelist_item *wh; 253 char maj[MAJMINLEN], min[MAJMINLEN], acc[ACCLEN]; 254 255 rcu_read_lock(); 256 list_for_each_entry_rcu(wh, &devcgroup->whitelist, list) { 257 set_access(acc, wh->access); 258 set_majmin(maj, wh->major); 259 set_majmin(min, wh->minor); 260 seq_printf(m, "%c %s:%s %s\n", type_to_char(wh->type), 261 maj, min, acc); 262 } 263 rcu_read_unlock(); 264 265 return 0; 266 } 267 268 /* 269 * may_access_whitelist: 270 * does the access granted to dev_cgroup c contain the access 271 * requested in whitelist item refwh. 272 * return 1 if yes, 0 if no. 273 * call with devcgroup_mutex held 274 */ 275 static int may_access_whitelist(struct dev_cgroup *c, 276 struct dev_whitelist_item *refwh) 277 { 278 struct dev_whitelist_item *whitem; 279 280 list_for_each_entry(whitem, &c->whitelist, list) { 281 if (whitem->type & DEV_ALL) 282 return 1; 283 if ((refwh->type & DEV_BLOCK) && !(whitem->type & DEV_BLOCK)) 284 continue; 285 if ((refwh->type & DEV_CHAR) && !(whitem->type & DEV_CHAR)) 286 continue; 287 if (whitem->major != ~0 && whitem->major != refwh->major) 288 continue; 289 if (whitem->minor != ~0 && whitem->minor != refwh->minor) 290 continue; 291 if (refwh->access & (~whitem->access)) 292 continue; 293 return 1; 294 } 295 return 0; 296 } 297 298 /* 299 * parent_has_perm: 300 * when adding a new allow rule to a device whitelist, the rule 301 * must be allowed in the parent device 302 */ 303 static int parent_has_perm(struct dev_cgroup *childcg, 304 struct dev_whitelist_item *wh) 305 { 306 struct cgroup *pcg = childcg->css.cgroup->parent; 307 struct dev_cgroup *parent; 308 309 if (!pcg) 310 return 1; 311 parent = cgroup_to_devcgroup(pcg); 312 return may_access_whitelist(parent, wh); 313 } 314 315 /* 316 * Modify the whitelist using allow/deny rules. 317 * CAP_SYS_ADMIN is needed for this. It's at least separate from CAP_MKNOD 318 * so we can give a container CAP_MKNOD to let it create devices but not 319 * modify the whitelist. 320 * It seems likely we'll want to add a CAP_CONTAINER capability to allow 321 * us to also grant CAP_SYS_ADMIN to containers without giving away the 322 * device whitelist controls, but for now we'll stick with CAP_SYS_ADMIN 323 * 324 * Taking rules away is always allowed (given CAP_SYS_ADMIN). Granting 325 * new access is only allowed if you're in the top-level cgroup, or your 326 * parent cgroup has the access you're asking for. 327 */ 328 static int devcgroup_update_access(struct dev_cgroup *devcgroup, 329 int filetype, const char *buffer) 330 { 331 const char *b; 332 char *endp; 333 int count; 334 struct dev_whitelist_item wh; 335 336 if (!capable(CAP_SYS_ADMIN)) 337 return -EPERM; 338 339 memset(&wh, 0, sizeof(wh)); 340 b = buffer; 341 342 switch (*b) { 343 case 'a': 344 wh.type = DEV_ALL; 345 wh.access = ACC_MASK; 346 wh.major = ~0; 347 wh.minor = ~0; 348 goto handle; 349 case 'b': 350 wh.type = DEV_BLOCK; 351 break; 352 case 'c': 353 wh.type = DEV_CHAR; 354 break; 355 default: 356 return -EINVAL; 357 } 358 b++; 359 if (!isspace(*b)) 360 return -EINVAL; 361 b++; 362 if (*b == '*') { 363 wh.major = ~0; 364 b++; 365 } else if (isdigit(*b)) { 366 wh.major = simple_strtoul(b, &endp, 10); 367 b = endp; 368 } else { 369 return -EINVAL; 370 } 371 if (*b != ':') 372 return -EINVAL; 373 b++; 374 375 /* read minor */ 376 if (*b == '*') { 377 wh.minor = ~0; 378 b++; 379 } else if (isdigit(*b)) { 380 wh.minor = simple_strtoul(b, &endp, 10); 381 b = endp; 382 } else { 383 return -EINVAL; 384 } 385 if (!isspace(*b)) 386 return -EINVAL; 387 for (b++, count = 0; count < 3; count++, b++) { 388 switch (*b) { 389 case 'r': 390 wh.access |= ACC_READ; 391 break; 392 case 'w': 393 wh.access |= ACC_WRITE; 394 break; 395 case 'm': 396 wh.access |= ACC_MKNOD; 397 break; 398 case '\n': 399 case '\0': 400 count = 3; 401 break; 402 default: 403 return -EINVAL; 404 } 405 } 406 407 handle: 408 switch (filetype) { 409 case DEVCG_ALLOW: 410 if (!parent_has_perm(devcgroup, &wh)) 411 return -EPERM; 412 return dev_whitelist_add(devcgroup, &wh); 413 case DEVCG_DENY: 414 dev_whitelist_rm(devcgroup, &wh); 415 break; 416 default: 417 return -EINVAL; 418 } 419 return 0; 420 } 421 422 static int devcgroup_access_write(struct cgroup *cgrp, struct cftype *cft, 423 const char *buffer) 424 { 425 int retval; 426 427 mutex_lock(&devcgroup_mutex); 428 retval = devcgroup_update_access(cgroup_to_devcgroup(cgrp), 429 cft->private, buffer); 430 mutex_unlock(&devcgroup_mutex); 431 return retval; 432 } 433 434 static struct cftype dev_cgroup_files[] = { 435 { 436 .name = "allow", 437 .write_string = devcgroup_access_write, 438 .private = DEVCG_ALLOW, 439 }, 440 { 441 .name = "deny", 442 .write_string = devcgroup_access_write, 443 .private = DEVCG_DENY, 444 }, 445 { 446 .name = "list", 447 .read_seq_string = devcgroup_seq_read, 448 .private = DEVCG_LIST, 449 }, 450 { } /* terminate */ 451 }; 452 453 struct cgroup_subsys devices_subsys = { 454 .name = "devices", 455 .can_attach = devcgroup_can_attach, 456 .create = devcgroup_create, 457 .destroy = devcgroup_destroy, 458 .subsys_id = devices_subsys_id, 459 .base_cftypes = dev_cgroup_files, 460 }; 461 462 int __devcgroup_inode_permission(struct inode *inode, int mask) 463 { 464 struct dev_cgroup *dev_cgroup; 465 struct dev_whitelist_item *wh; 466 467 rcu_read_lock(); 468 469 dev_cgroup = task_devcgroup(current); 470 471 list_for_each_entry_rcu(wh, &dev_cgroup->whitelist, list) { 472 if (wh->type & DEV_ALL) 473 goto found; 474 if ((wh->type & DEV_BLOCK) && !S_ISBLK(inode->i_mode)) 475 continue; 476 if ((wh->type & DEV_CHAR) && !S_ISCHR(inode->i_mode)) 477 continue; 478 if (wh->major != ~0 && wh->major != imajor(inode)) 479 continue; 480 if (wh->minor != ~0 && wh->minor != iminor(inode)) 481 continue; 482 483 if ((mask & MAY_WRITE) && !(wh->access & ACC_WRITE)) 484 continue; 485 if ((mask & MAY_READ) && !(wh->access & ACC_READ)) 486 continue; 487 found: 488 rcu_read_unlock(); 489 return 0; 490 } 491 492 rcu_read_unlock(); 493 494 return -EPERM; 495 } 496 497 int devcgroup_inode_mknod(int mode, dev_t dev) 498 { 499 struct dev_cgroup *dev_cgroup; 500 struct dev_whitelist_item *wh; 501 502 if (!S_ISBLK(mode) && !S_ISCHR(mode)) 503 return 0; 504 505 rcu_read_lock(); 506 507 dev_cgroup = task_devcgroup(current); 508 509 list_for_each_entry_rcu(wh, &dev_cgroup->whitelist, list) { 510 if (wh->type & DEV_ALL) 511 goto found; 512 if ((wh->type & DEV_BLOCK) && !S_ISBLK(mode)) 513 continue; 514 if ((wh->type & DEV_CHAR) && !S_ISCHR(mode)) 515 continue; 516 if (wh->major != ~0 && wh->major != MAJOR(dev)) 517 continue; 518 if (wh->minor != ~0 && wh->minor != MINOR(dev)) 519 continue; 520 521 if (!(wh->access & ACC_MKNOD)) 522 continue; 523 found: 524 rcu_read_unlock(); 525 return 0; 526 } 527 528 rcu_read_unlock(); 529 530 return -EPERM; 531 } 532