aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--security/device_cgroup.c21
1 files changed, 12 insertions, 9 deletions
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index 1c69e38e3a2c..4ad55a9c6920 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -305,8 +305,8 @@ static int devcgroup_seq_read(struct cgroup *cgroup, struct cftype *cft,
305 * @dev_cgroup: dev cgroup to be tested against 305 * @dev_cgroup: dev cgroup to be tested against
306 * @refex: new exception 306 * @refex: new exception
307 */ 307 */
308static int may_access(struct dev_cgroup *dev_cgroup, 308static bool may_access(struct dev_cgroup *dev_cgroup,
309 struct dev_exception_item *refex) 309 struct dev_exception_item *refex)
310{ 310{
311 struct dev_exception_item *ex; 311 struct dev_exception_item *ex;
312 bool match = false; 312 bool match = false;
@@ -332,16 +332,19 @@ static int may_access(struct dev_cgroup *dev_cgroup,
332 332
333 /* 333 /*
334 * In two cases we'll consider this new exception valid: 334 * In two cases we'll consider this new exception valid:
335 * - the dev cgroup has its default policy to allow + exception list:
336 * the new exception should *not* match any of the exceptions
337 * (behavior == DEVCG_DEFAULT_ALLOW, !match)
338 * - the dev cgroup has its default policy to deny + exception list: 335 * - the dev cgroup has its default policy to deny + exception list:
339 * the new exception *should* match the exceptions 336 * the new exception *should* match the exceptions
340 * (behavior == DEVCG_DEFAULT_DENY, match) 337 * - the dev cgroup has its default policy to allow + exception list:
338 * the new exception should *not* match any of the exceptions
341 */ 339 */
342 if ((dev_cgroup->behavior == DEVCG_DEFAULT_DENY) == match) 340 if (dev_cgroup->behavior == DEVCG_DEFAULT_DENY) {
343 return 1; 341 if (match)
344 return 0; 342 return true;
343 } else {
344 if (!match)
345 return true;
346 }
347 return false;
345} 348}
346 349
347/* 350/*