2 * device_cgroup.c - device cgroup subsystem
4 * Copyright 2007 IBM Corp
7 #include <linux/device_cgroup.h>
8 #include <linux/cgroup.h>
9 #include <linux/ctype.h>
10 #include <linux/list.h>
11 #include <linux/uaccess.h>
12 #include <linux/seq_file.h>
13 #include <linux/slab.h>
14 #include <linux/rcupdate.h>
15 #include <linux/mutex.h>
20 #define ACC_MASK (ACC_MKNOD | ACC_READ | ACC_WRITE)
24 #define DEV_ALL 4 /* this represents all devices */
26 static DEFINE_MUTEX(devcgroup_mutex
);
35 * exception list locking rules:
36 * hold devcgroup_mutex for update/read.
37 * hold rcu_read_lock() for read.
40 struct dev_exception_item
{
44 struct list_head list
;
49 struct cgroup_subsys_state css
;
50 struct list_head exceptions
;
51 enum devcg_behavior behavior
;
54 static inline struct dev_cgroup
*css_to_devcgroup(struct cgroup_subsys_state
*s
)
56 return s
? container_of(s
, struct dev_cgroup
, css
) : NULL
;
59 static inline struct dev_cgroup
*cgroup_to_devcgroup(struct cgroup
*cgroup
)
61 return css_to_devcgroup(cgroup_css(cgroup
, devices_subsys_id
));
64 static inline struct dev_cgroup
*task_devcgroup(struct task_struct
*task
)
66 return css_to_devcgroup(task_css(task
, devices_subsys_id
));
69 struct cgroup_subsys devices_subsys
;
71 static int devcgroup_can_attach(struct cgroup_subsys_state
*new_css
,
72 struct cgroup_taskset
*set
)
74 struct task_struct
*task
= cgroup_taskset_first(set
);
76 if (current
!= task
&& !capable(CAP_SYS_ADMIN
))
82 * called under devcgroup_mutex
84 static int dev_exceptions_copy(struct list_head
*dest
, struct list_head
*orig
)
86 struct dev_exception_item
*ex
, *tmp
, *new;
88 lockdep_assert_held(&devcgroup_mutex
);
90 list_for_each_entry(ex
, orig
, list
) {
91 new = kmemdup(ex
, sizeof(*ex
), GFP_KERNEL
);
94 list_add_tail(&new->list
, dest
);
100 list_for_each_entry_safe(ex
, tmp
, dest
, list
) {
108 * called under devcgroup_mutex
110 static int dev_exception_add(struct dev_cgroup
*dev_cgroup
,
111 struct dev_exception_item
*ex
)
113 struct dev_exception_item
*excopy
, *walk
;
115 lockdep_assert_held(&devcgroup_mutex
);
117 excopy
= kmemdup(ex
, sizeof(*ex
), GFP_KERNEL
);
121 list_for_each_entry(walk
, &dev_cgroup
->exceptions
, list
) {
122 if (walk
->type
!= ex
->type
)
124 if (walk
->major
!= ex
->major
)
126 if (walk
->minor
!= ex
->minor
)
129 walk
->access
|= ex
->access
;
135 list_add_tail_rcu(&excopy
->list
, &dev_cgroup
->exceptions
);
140 * called under devcgroup_mutex
142 static void dev_exception_rm(struct dev_cgroup
*dev_cgroup
,
143 struct dev_exception_item
*ex
)
145 struct dev_exception_item
*walk
, *tmp
;
147 lockdep_assert_held(&devcgroup_mutex
);
149 list_for_each_entry_safe(walk
, tmp
, &dev_cgroup
->exceptions
, list
) {
150 if (walk
->type
!= ex
->type
)
152 if (walk
->major
!= ex
->major
)
154 if (walk
->minor
!= ex
->minor
)
157 walk
->access
&= ~ex
->access
;
159 list_del_rcu(&walk
->list
);
160 kfree_rcu(walk
, rcu
);
165 static void __dev_exception_clean(struct dev_cgroup
*dev_cgroup
)
167 struct dev_exception_item
*ex
, *tmp
;
169 list_for_each_entry_safe(ex
, tmp
, &dev_cgroup
->exceptions
, list
) {
170 list_del_rcu(&ex
->list
);
176 * dev_exception_clean - frees all entries of the exception list
177 * @dev_cgroup: dev_cgroup with the exception list to be cleaned
179 * called under devcgroup_mutex
181 static void dev_exception_clean(struct dev_cgroup
*dev_cgroup
)
183 lockdep_assert_held(&devcgroup_mutex
);
185 __dev_exception_clean(dev_cgroup
);
188 static inline bool is_devcg_online(const struct dev_cgroup
*devcg
)
190 return (devcg
->behavior
!= DEVCG_DEFAULT_NONE
);
194 * devcgroup_online - initializes devcgroup's behavior and exceptions based on
196 * @css: css getting online
197 * returns 0 in case of success, error code otherwise
199 static int devcgroup_online(struct cgroup_subsys_state
*css
)
201 struct dev_cgroup
*dev_cgroup
= css_to_devcgroup(css
);
202 struct dev_cgroup
*parent_dev_cgroup
= css_to_devcgroup(css_parent(css
));
205 mutex_lock(&devcgroup_mutex
);
207 if (parent_dev_cgroup
== NULL
)
208 dev_cgroup
->behavior
= DEVCG_DEFAULT_ALLOW
;
210 ret
= dev_exceptions_copy(&dev_cgroup
->exceptions
,
211 &parent_dev_cgroup
->exceptions
);
213 dev_cgroup
->behavior
= parent_dev_cgroup
->behavior
;
215 mutex_unlock(&devcgroup_mutex
);
220 static void devcgroup_offline(struct cgroup_subsys_state
*css
)
222 struct dev_cgroup
*dev_cgroup
= css_to_devcgroup(css
);
224 mutex_lock(&devcgroup_mutex
);
225 dev_cgroup
->behavior
= DEVCG_DEFAULT_NONE
;
226 mutex_unlock(&devcgroup_mutex
);
230 * called from kernel/cgroup.c with cgroup_lock() held.
232 static struct cgroup_subsys_state
*
233 devcgroup_css_alloc(struct cgroup_subsys_state
*parent_css
)
235 struct dev_cgroup
*dev_cgroup
;
237 dev_cgroup
= kzalloc(sizeof(*dev_cgroup
), GFP_KERNEL
);
239 return ERR_PTR(-ENOMEM
);
240 INIT_LIST_HEAD(&dev_cgroup
->exceptions
);
241 dev_cgroup
->behavior
= DEVCG_DEFAULT_NONE
;
243 return &dev_cgroup
->css
;
246 static void devcgroup_css_free(struct cgroup_subsys_state
*css
)
248 struct dev_cgroup
*dev_cgroup
= css_to_devcgroup(css
);
250 __dev_exception_clean(dev_cgroup
);
254 #define DEVCG_ALLOW 1
261 static void set_access(char *acc
, short access
)
264 memset(acc
, 0, ACCLEN
);
265 if (access
& ACC_READ
)
267 if (access
& ACC_WRITE
)
269 if (access
& ACC_MKNOD
)
273 static char type_to_char(short type
)
277 if (type
== DEV_CHAR
)
279 if (type
== DEV_BLOCK
)
284 static void set_majmin(char *str
, unsigned m
)
289 sprintf(str
, "%u", m
);
292 static int devcgroup_seq_read(struct cgroup_subsys_state
*css
,
293 struct cftype
*cft
, struct seq_file
*m
)
295 struct dev_cgroup
*devcgroup
= css_to_devcgroup(css
);
296 struct dev_exception_item
*ex
;
297 char maj
[MAJMINLEN
], min
[MAJMINLEN
], acc
[ACCLEN
];
301 * To preserve the compatibility:
302 * - Only show the "all devices" when the default policy is to allow
303 * - List the exceptions in case the default policy is to deny
304 * This way, the file remains as a "whitelist of devices"
306 if (devcgroup
->behavior
== DEVCG_DEFAULT_ALLOW
) {
307 set_access(acc
, ACC_MASK
);
310 seq_printf(m
, "%c %s:%s %s\n", type_to_char(DEV_ALL
),
313 list_for_each_entry_rcu(ex
, &devcgroup
->exceptions
, list
) {
314 set_access(acc
, ex
->access
);
315 set_majmin(maj
, ex
->major
);
316 set_majmin(min
, ex
->minor
);
317 seq_printf(m
, "%c %s:%s %s\n", type_to_char(ex
->type
),
327 * may_access - verifies if a new exception is part of what is allowed
328 * by a dev cgroup based on the default policy +
329 * exceptions. This is used to make sure a child cgroup
330 * won't have more privileges than its parent or to
331 * verify if a certain access is allowed.
332 * @dev_cgroup: dev cgroup to be tested against
333 * @refex: new exception
334 * @behavior: behavior of the exception
336 static bool may_access(struct dev_cgroup
*dev_cgroup
,
337 struct dev_exception_item
*refex
,
338 enum devcg_behavior behavior
)
340 struct dev_exception_item
*ex
;
343 rcu_lockdep_assert(rcu_read_lock_held() ||
344 lockdep_is_held(&devcgroup_mutex
),
345 "device_cgroup::may_access() called without proper synchronization");
347 list_for_each_entry_rcu(ex
, &dev_cgroup
->exceptions
, list
) {
348 if ((refex
->type
& DEV_BLOCK
) && !(ex
->type
& DEV_BLOCK
))
350 if ((refex
->type
& DEV_CHAR
) && !(ex
->type
& DEV_CHAR
))
352 if (ex
->major
!= ~0 && ex
->major
!= refex
->major
)
354 if (ex
->minor
!= ~0 && ex
->minor
!= refex
->minor
)
356 if (refex
->access
& (~ex
->access
))
362 if (dev_cgroup
->behavior
== DEVCG_DEFAULT_ALLOW
) {
363 if (behavior
== DEVCG_DEFAULT_ALLOW
) {
364 /* the exception will deny access to certain devices */
367 /* the exception will allow access to certain devices */
370 * a new exception allowing access shouldn't
371 * match an parent's exception
377 /* only behavior == DEVCG_DEFAULT_DENY allowed here */
379 /* parent has an exception that matches the proposed */
389 * when adding a new allow rule to a device exception list, the rule
390 * must be allowed in the parent device
392 static int parent_has_perm(struct dev_cgroup
*childcg
,
393 struct dev_exception_item
*ex
)
395 struct dev_cgroup
*parent
= css_to_devcgroup(css_parent(&childcg
->css
));
399 return may_access(parent
, ex
, childcg
->behavior
);
403 * may_allow_all - checks if it's possible to change the behavior to
404 * allow based on parent's rules.
405 * @parent: device cgroup's parent
406 * returns: != 0 in case it's allowed, 0 otherwise
408 static inline int may_allow_all(struct dev_cgroup
*parent
)
412 return parent
->behavior
== DEVCG_DEFAULT_ALLOW
;
416 * revalidate_active_exceptions - walks through the active exception list and
417 * revalidates the exceptions based on parent's
418 * behavior and exceptions. The exceptions that
419 * are no longer valid will be removed.
420 * Called with devcgroup_mutex held.
421 * @devcg: cgroup which exceptions will be checked
423 * This is one of the three key functions for hierarchy implementation.
424 * This function is responsible for re-evaluating all the cgroup's active
425 * exceptions due to a parent's exception change.
426 * Refer to Documentation/cgroups/devices.txt for more details.
428 static void revalidate_active_exceptions(struct dev_cgroup
*devcg
)
430 struct dev_exception_item
*ex
;
431 struct list_head
*this, *tmp
;
433 list_for_each_safe(this, tmp
, &devcg
->exceptions
) {
434 ex
= container_of(this, struct dev_exception_item
, list
);
435 if (!parent_has_perm(devcg
, ex
))
436 dev_exception_rm(devcg
, ex
);
441 * propagate_exception - propagates a new exception to the children
442 * @devcg_root: device cgroup that added a new exception
443 * @ex: new exception to be propagated
445 * returns: 0 in case of success, != 0 in case of error
447 static int propagate_exception(struct dev_cgroup
*devcg_root
,
448 struct dev_exception_item
*ex
)
450 struct cgroup
*root
= devcg_root
->css
.cgroup
, *pos
;
455 cgroup_for_each_descendant_pre(pos
, root
) {
456 struct dev_cgroup
*devcg
= cgroup_to_devcgroup(pos
);
459 * Because devcgroup_mutex is held, no devcg will become
460 * online or offline during the tree walk (see on/offline
461 * methods), and online ones are safe to access outside RCU
462 * read lock without bumping refcnt.
464 if (!is_devcg_online(devcg
))
470 * in case both root's behavior and devcg is allow, a new
471 * restriction means adding to the exception list
473 if (devcg_root
->behavior
== DEVCG_DEFAULT_ALLOW
&&
474 devcg
->behavior
== DEVCG_DEFAULT_ALLOW
) {
475 rc
= dev_exception_add(devcg
, ex
);
480 * in the other possible cases:
481 * root's behavior: allow, devcg's: deny
482 * root's behavior: deny, devcg's: deny
483 * the exception will be removed
485 dev_exception_rm(devcg
, ex
);
487 revalidate_active_exceptions(devcg
);
496 static inline bool has_children(struct dev_cgroup
*devcgroup
)
498 struct cgroup
*cgrp
= devcgroup
->css
.cgroup
;
500 return !list_empty(&cgrp
->children
);
504 * Modify the exception list using allow/deny rules.
505 * CAP_SYS_ADMIN is needed for this. It's at least separate from CAP_MKNOD
506 * so we can give a container CAP_MKNOD to let it create devices but not
507 * modify the exception list.
508 * It seems likely we'll want to add a CAP_CONTAINER capability to allow
509 * us to also grant CAP_SYS_ADMIN to containers without giving away the
510 * device exception list controls, but for now we'll stick with CAP_SYS_ADMIN
512 * Taking rules away is always allowed (given CAP_SYS_ADMIN). Granting
513 * new access is only allowed if you're in the top-level cgroup, or your
514 * parent cgroup has the access you're asking for.
516 static int devcgroup_update_access(struct dev_cgroup
*devcgroup
,
517 int filetype
, const char *buffer
)
520 char temp
[12]; /* 11 + 1 characters needed for a u32 */
522 struct dev_exception_item ex
;
523 struct dev_cgroup
*parent
= css_to_devcgroup(css_parent(&devcgroup
->css
));
525 if (!capable(CAP_SYS_ADMIN
))
528 memset(&ex
, 0, sizeof(ex
));
535 if (has_children(devcgroup
))
538 if (!may_allow_all(parent
))
540 dev_exception_clean(devcgroup
);
541 devcgroup
->behavior
= DEVCG_DEFAULT_ALLOW
;
545 rc
= dev_exceptions_copy(&devcgroup
->exceptions
,
546 &parent
->exceptions
);
551 if (has_children(devcgroup
))
554 dev_exception_clean(devcgroup
);
555 devcgroup
->behavior
= DEVCG_DEFAULT_DENY
;
577 } else if (isdigit(*b
)) {
578 memset(temp
, 0, sizeof(temp
));
579 for (count
= 0; count
< sizeof(temp
) - 1; count
++) {
585 rc
= kstrtou32(temp
, 10, &ex
.major
);
599 } else if (isdigit(*b
)) {
600 memset(temp
, 0, sizeof(temp
));
601 for (count
= 0; count
< sizeof(temp
) - 1; count
++) {
607 rc
= kstrtou32(temp
, 10, &ex
.minor
);
615 for (b
++, count
= 0; count
< 3; count
++, b
++) {
618 ex
.access
|= ACC_READ
;
621 ex
.access
|= ACC_WRITE
;
624 ex
.access
|= ACC_MKNOD
;
637 if (!parent_has_perm(devcgroup
, &ex
))
640 * If the default policy is to allow by default, try to remove
641 * an matching exception instead. And be silent about it: we
642 * don't want to break compatibility
644 if (devcgroup
->behavior
== DEVCG_DEFAULT_ALLOW
) {
645 dev_exception_rm(devcgroup
, &ex
);
648 rc
= dev_exception_add(devcgroup
, &ex
);
652 * If the default policy is to deny by default, try to remove
653 * an matching exception instead. And be silent about it: we
654 * don't want to break compatibility
656 if (devcgroup
->behavior
== DEVCG_DEFAULT_DENY
)
657 dev_exception_rm(devcgroup
, &ex
);
659 rc
= dev_exception_add(devcgroup
, &ex
);
663 /* we only propagate new restrictions */
664 rc
= propagate_exception(devcgroup
, &ex
);
672 static int devcgroup_access_write(struct cgroup_subsys_state
*css
,
673 struct cftype
*cft
, const char *buffer
)
677 mutex_lock(&devcgroup_mutex
);
678 retval
= devcgroup_update_access(css_to_devcgroup(css
),
679 cft
->private, buffer
);
680 mutex_unlock(&devcgroup_mutex
);
684 static struct cftype dev_cgroup_files
[] = {
687 .write_string
= devcgroup_access_write
,
688 .private = DEVCG_ALLOW
,
692 .write_string
= devcgroup_access_write
,
693 .private = DEVCG_DENY
,
697 .read_seq_string
= devcgroup_seq_read
,
698 .private = DEVCG_LIST
,
703 struct cgroup_subsys devices_subsys
= {
705 .can_attach
= devcgroup_can_attach
,
706 .css_alloc
= devcgroup_css_alloc
,
707 .css_free
= devcgroup_css_free
,
708 .css_online
= devcgroup_online
,
709 .css_offline
= devcgroup_offline
,
710 .subsys_id
= devices_subsys_id
,
711 .base_cftypes
= dev_cgroup_files
,
715 * __devcgroup_check_permission - checks if an inode operation is permitted
716 * @dev_cgroup: the dev cgroup to be tested against
718 * @major: device major number
719 * @minor: device minor number
720 * @access: combination of ACC_WRITE, ACC_READ and ACC_MKNOD
722 * returns 0 on success, -EPERM case the operation is not permitted
724 static int __devcgroup_check_permission(short type
, u32 major
, u32 minor
,
727 struct dev_cgroup
*dev_cgroup
;
728 struct dev_exception_item ex
;
731 memset(&ex
, 0, sizeof(ex
));
738 dev_cgroup
= task_devcgroup(current
);
739 rc
= may_access(dev_cgroup
, &ex
, dev_cgroup
->behavior
);
748 int __devcgroup_inode_permission(struct inode
*inode
, int mask
)
750 short type
, access
= 0;
752 if (S_ISBLK(inode
->i_mode
))
754 if (S_ISCHR(inode
->i_mode
))
756 if (mask
& MAY_WRITE
)
761 return __devcgroup_check_permission(type
, imajor(inode
), iminor(inode
),
765 int devcgroup_inode_mknod(int mode
, dev_t dev
)
769 if (!S_ISBLK(mode
) && !S_ISCHR(mode
))
777 return __devcgroup_check_permission(type
, MAJOR(dev
), MINOR(dev
),