iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

devscgroup: check for device permissions at mount time

Browse Source 
Currently even if a task sits in an all-denied cgroup it can still mount
any block device in any mode it wants.

Put a proper check in do_open for block device to prevent this.

Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Tested-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Pavel Emelyanov 2008-06-05 22:46:27 -07:00 committed by Linus Torvalds
parent cc9cb219aa
commit 7db9cfd380
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
fs/block_dev.c
View File

@ -12,6 +12,7 @@
#include <linux/kmod.h> #include <linux/kmod.h>
#include <linux/major.h> #include <linux/major.h>
#include <linux/smp_lock.h> #include <linux/smp_lock.h>
#include <linux/device_cgroup.h>
#include <linux/highmem.h> #include <linux/highmem.h>
#include <linux/blkdev.h> #include <linux/blkdev.h>
#include <linux/module.h> #include <linux/module.h>
@ -928,9 +929,14 @@ static int do_open(struct block_device *bdev, struct file *file, int for_part)
{ {
struct module *owner = NULL; struct module *owner = NULL;
struct gendisk *disk; struct gendisk *disk;
int ret = -ENXIO; int ret;
int part; int part;
ret = devcgroup_inode_permission(bdev->bd_inode, file->f_mode);
if (ret != 0)
return ret;
ret = -ENXIO;
file->f_mapping = bdev->bd_inode->i_mapping; file->f_mapping = bdev->bd_inode->i_mapping;
lock_kernel(); lock_kernel();
disk = get_gendisk(bdev->bd_dev, &part); disk = get_gendisk(bdev->bd_dev, &part);