diff options
| author | Li Zefan <[email protected]> | 2008-07-13 12:14:04 -0700 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2008-07-13 12:51:18 -0700 |
| commit | ec229e830060091b9be63c8f873c1b2407a82821 (patch) | |
| tree | 505231f1cad4a3258d509dfc75e47ed445647ff6 | |
| parent | 17d213f806dad629e9af36fc45f082b87ed7bceb (diff) | |
devcgroup: fix permission check when adding entry to child cgroup
# cat devices.list
c 1:3 r
# echo 'c 1:3 w' > sub/devices.allow
# cat sub/devices.list
c 1:3 w
As illustrated, the parent group has no write permission to /dev/null, so
it's child should not be allowed to add this write permission.
Signed-off-by: Li Zefan <[email protected]>
Acked-by: Serge Hallyn <[email protected]>
Cc: Serge Hallyn <[email protected]>
Cc: Paul Menage <[email protected]>
Cc: Pavel Emelyanov <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
| -rw-r--r-- | security/device_cgroup.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/security/device_cgroup.c b/security/device_cgroup.c index 1e2e28afba45..ddd92cec78ed 100644 --- a/security/device_cgroup.c +++ b/security/device_cgroup.c @@ -300,7 +300,7 @@ static int may_access_whitelist(struct dev_cgroup *c, continue; if (whitem->minor != ~0 && whitem->minor != refwh->minor) continue; - if (refwh->access & (~(whitem->access | ACC_MASK))) + if (refwh->access & (~whitem->access)) continue; return 1; } |