| From 0b82ac37b889ec881b645860da3775118effb3ca Mon Sep 17 00:00:00 2001 |
| From: Serge E. Hallyn <serue@us.ibm.com> |
| Date: Wed, 7 Jan 2009 18:07:46 -0800 |
| Subject: devices cgroup: allow mkfifo |
| |
| From: Serge E. Hallyn <serue@us.ibm.com> |
| |
| commit 0b82ac37b889ec881b645860da3775118effb3ca upstream. |
| |
| The devcgroup_inode_permission() hook in the devices whitelist cgroup has |
| always bypassed access checks on fifos. But the mknod hook did not. The |
| devices whitelist is only about block and char devices, and fifos can't |
| even be added to the whitelist, so fifos can't be created at all except by |
| tasks which have 'a' in their whitelist (meaning they have access to all |
| devices). |
| |
| Fix the behavior by bypassing access checks to mkfifo. |
| |
| Signed-off-by: Serge E. Hallyn <serue@us.ibm.com> |
| Cc: Li Zefan <lizf@cn.fujitsu.com> |
| Cc: Pavel Emelyanov <xemul@openvz.org> |
| Cc: Paul Menage <menage@google.com> |
| Cc: Lai Jiangshan <laijs@cn.fujitsu.com> |
| Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> |
| Cc: James Morris <jmorris@namei.org> |
| Reported-by: Daniel Lezcano <dlezcano@fr.ibm.com> |
| Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| security/device_cgroup.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| --- a/security/device_cgroup.c |
| +++ b/security/device_cgroup.c |
| @@ -543,6 +543,9 @@ int devcgroup_inode_mknod(int mode, dev_ |
| struct dev_cgroup *dev_cgroup; |
| struct dev_whitelist_item *wh; |
| |
| + if (!S_ISBLK(mode) && !S_ISCHR(mode)) |
| + return 0; |
| + |
| rcu_read_lock(); |
| |
| dev_cgroup = task_devcgroup(current); |
