aboutsummaryrefslogtreecommitdiffstats
path: root/security/device_cgroup.c
diff options
context:
space:
mode:
authorLi Zefan <lizf@cn.fujitsu.com>2008-07-13 15:14:04 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2008-07-13 15:51:18 -0400
commitec229e830060091b9be63c8f873c1b2407a82821 (patch)
tree505231f1cad4a3258d509dfc75e47ed445647ff6 /security/device_cgroup.c
parent17d213f806dad629e9af36fc45f082b87ed7bceb (diff)
devcgroup: fix permission check when adding entry to child cgroup
# cat devices.list c 1:3 r # echo 'c 1:3 w' > sub/devices.allow # cat sub/devices.list c 1:3 w As illustrated, the parent group has no write permission to /dev/null, so it's child should not be allowed to add this write permission. Signed-off-by: Li Zefan <lizf@cn.fujitsu.com> Acked-by: Serge Hallyn <serue@us.ibm.com> Cc: Serge Hallyn <serue@us.ibm.com> Cc: Paul Menage <menage@google.com> Cc: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'security/device_cgroup.c')
-rw-r--r--security/device_cgroup.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index 1e2e28afba45..ddd92cec78ed 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -300,7 +300,7 @@ static int may_access_whitelist(struct dev_cgroup *c,
300 continue; 300 continue;
301 if (whitem->minor != ~0 && whitem->minor != refwh->minor) 301 if (whitem->minor != ~0 && whitem->minor != refwh->minor)
302 continue; 302 continue;
303 if (refwh->access & (~(whitem->access | ACC_MASK))) 303 if (refwh->access & (~whitem->access))
304 continue; 304 continue;
305 return 1; 305 return 1;
306 } 306 }