diff options
| author | Li Zefan <lizf@cn.fujitsu.com> | 2008-07-13 12:14:04 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2008-07-13 12:51:18 -0700 |
| commit | ec229e830060091b9be63c8f873c1b2407a82821 (patch) | |
| tree | 505231f1cad4a3258d509dfc75e47ed445647ff6 | |
| parent | 17d213f806dad629e9af36fc45f082b87ed7bceb (diff) | |
| download | linux-3.10-ec229e830060091b9be63c8f873c1b2407a82821.tar.gz linux-3.10-ec229e830060091b9be63c8f873c1b2407a82821.tar.bz2 linux-3.10-ec229e830060091b9be63c8f873c1b2407a82821.zip | |
devcgroup: fix permission check when adding entry to child cgroup
# cat devices.list
c 1:3 r
# echo 'c 1:3 w' > sub/devices.allow
# cat sub/devices.list
c 1:3 w
As illustrated, the parent group has no write permission to /dev/null, so
it's child should not be allowed to add this write permission.
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Cc: Serge Hallyn <serue@us.ibm.com>
Cc: Paul Menage <menage@google.com>
Cc: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| -rw-r--r-- | security/device_cgroup.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/security/device_cgroup.c b/security/device_cgroup.c index 1e2e28afba4..ddd92cec78e 100644 --- a/security/device_cgroup.c +++ b/security/device_cgroup.c @@ -300,7 +300,7 @@ static int may_access_whitelist(struct dev_cgroup *c, continue; if (whitem->minor != ~0 && whitem->minor != refwh->minor) continue; - if (refwh->access & (~(whitem->access | ACC_MASK))) + if (refwh->access & (~whitem->access)) continue; return 1; } |