Commit d2c2b11c authored by Aristeu Rozanski's avatar Aristeu Rozanski Committed by Tejun Heo
Browse files

device_cgroup: check if exception removal is allowed

[PATCH v3 1/2] device_cgroup: check if exception removal is allowed

When the device cgroup hierarchy was introduced in

 - devcg: propagate local changes down the hierarchy

a specific case was overlooked. Consider the hierarchy bellow:

	A	default policy: ALLOW, exceptions will deny access
	  B	default policy: ALLOW, exceptions will deny access

There's no need to verify when an new exception is added to B because
in this case exceptions will deny access to further devices, which is
always fine. Hierarchy in device cgroup only makes sure B won't have
more access than A.

But when an exception is removed (by writing devices.allow), it isn't
checked if the user is in fact removing an inherited exception from A,
thus giving more access to B.


	# echo 'a' >A/devices.allow
	# echo 'c 1:3 rw' >A/devices.deny
	# echo $$ >A/B/tasks
	# echo >/dev/null
	-bash: /dev/null: Operation not permitted
	# echo 'c 1:3 w' >A/B/devices.allow
	# echo >/dev/null

This shouldn't be allowed and this patch fixes it by making sure to never allow
exceptions in this case to be removed if the exception is partially or fully
present on the parent.

v3: missing '*' in function description
v2: improved log message and formatting fixes

Cc: Li Zefan <>
Signed-off-by: default avatarAristeu Rozanski <>
Acked-by: default avatarSerge Hallyn <>
Signed-off-by: default avatarTejun Heo <>
parent f5f3cf6f
......@@ -462,6 +462,37 @@ static int parent_has_perm(struct dev_cgroup *childcg,
return verify_new_ex(parent, ex, childcg->behavior);
* parent_allows_removal - verify if it's ok to remove an exception
* @childcg: child cgroup from where the exception will be removed
* @ex: exception being removed
* When removing an exception in cgroups with default ALLOW policy, it must
* be checked if removing it will give the child cgroup more access than the
* parent.
* Return: true if it's ok to remove exception, false otherwise
static bool parent_allows_removal(struct dev_cgroup *childcg,
struct dev_exception_item *ex)
struct dev_cgroup *parent = css_to_devcgroup(css_parent(&childcg->css));
if (!parent)
return true;
/* It's always allowed to remove access to devices */
if (childcg->behavior == DEVCG_DEFAULT_DENY)
return true;
* Make sure you're not removing part or a whole exception existing in
* the parent cgroup
return !match_exception_partial(&parent->exceptions, ex->type,
ex->major, ex->minor, ex->access);
* may_allow_all - checks if it's possible to change the behavior to
* allow based on parent's rules.
......@@ -697,17 +728,21 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
switch (filetype) {
if (!parent_has_perm(devcgroup, &ex))
return -EPERM;
* If the default policy is to allow by default, try to remove
* an matching exception instead. And be silent about it: we
* don't want to break compatibility
if (devcgroup->behavior == DEVCG_DEFAULT_ALLOW) {
/* Check if the parent allows removing it first */
if (!parent_allows_removal(devcgroup, &ex))
return -EPERM;
dev_exception_rm(devcgroup, &ex);
return 0;
if (!parent_has_perm(devcgroup, &ex))
return -EPERM;
rc = dev_exception_add(devcgroup, &ex);
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment