Commit d823f6bf authored by Li Zefan's avatar Li Zefan Committed by Linus Torvalds

devcgroup: fix odd behaviour when writing 'a' to devices.allow

 # cat /devcg/devices.list
 a *:* rwm
 # echo a > devices.allow
 # cat /devcg/devices.list
 a *:* rwm
 a 0:0 rwm

This is odd and maybe confusing.  With this patch, writing 'a' to
devices.allow will add 'a *:* rwm' to the whitelist.

Also a few fixes and updates to the document.
Signed-off-by: default avatarLi Zefan <lizf@cn.fujitsu.com>
Cc: Pavel Emelyanov <xemul@openvz.org>
Cc: Serge E. Hallyn <serue@us.ibm.com>
Cc: Paul Menage <menage@google.com>
Cc: Balbir Singh <balbir@in.ibm.com>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 26ff8c69
......@@ -13,7 +13,7 @@ either an integer or * for all. Access is a composition of r
The root device cgroup starts with rwm to 'all'. A child device
cgroup gets a copy of the parent. Administrators can then remove
devices from the whitelist or add new entries. A child cgroup can
never receive a device access which is denied its parent. However
never receive a device access which is denied by its parent. However
when a device access is removed from a parent it will not also be
removed from the child(ren).
......@@ -29,7 +29,11 @@ allows cgroup 1 to read and mknod the device usually known as
echo a > /cgroups/1/devices.deny
will remove the default 'a *:* mrw' entry.
will remove the default 'a *:* rwm' entry. Doing
echo a > /cgroups/1/devices.allow
will add the 'a *:* rwm' entry to the whitelist.
3. Security
......
......@@ -382,6 +382,8 @@ static ssize_t devcgroup_access_write(struct cgroup *cgroup, struct cftype *cft,
case 'a':
wh.type = DEV_ALL;
wh.access = ACC_MASK;
wh.major = ~0;
wh.minor = ~0;
goto handle;
case 'b':
wh.type = DEV_BLOCK;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment