lkml.org 
[lkml]   [2013]   [Jan]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [PATCH v4 9/9] devcg: propagate local changes down the hierarchy
Quoting aris@redhat.com (aris@redhat.com):
...
> New exceptions allowing additional access to devices won't be propagated, but
> it'll be possible to add an exception to access all of part of the newly
> allowed device(s).

Is that intended to apply only to only in the DEFAULT_DENY case? If so
that should be made clear. If not,

...

> @@ -515,11 +673,13 @@ memset(&ex, 0, sizeof(ex));
> &parent->exceptions);
> devcgroup->behavior = DEVCG_DEFAULT_ALLOW;
> devcgroup->local.behavior = DEVCG_DEFAULT_ALLOW;
> + rc = propagate_behavior(devcgroup);
> break;
> case DEVCG_DENY:
> dev_exception_clean_all(devcgroup);
> devcgroup->behavior = DEVCG_DEFAULT_DENY;
> devcgroup->local.behavior = DEVCG_DEFAULT_DENY;
> + rc = propagate_behavior(devcgroup);
> break;
> default:
> rc = -EINVAL;
> @@ -610,9 +770,14 @@ case '\0':
> */
> if (devcgroup->behavior == DEVCG_DEFAULT_ALLOW) {
> dev_exception_rm(devcgroup, &ex);
> - return 0;
> + rc = propagate_exception(devcgroup);

Let's say the default in both parent A and child B is ALLOW, and both
have a blacklist entry for "b 8:* rwm". Now I

echo "b 8:* rwm" > A/devices.allow

removing the blacklist entry. Here you are propagating that to the
child B, which I would argue is actually propagating a new allow to
a child. Which you said you wouldn't do.

> + return rc;
> }
> - return dev_exception_add(devcgroup, &ex);
> + rc = dev_exception_add(devcgroup, &ex);
> + if (!rc)
> + /* if a local behavior wasn't explicitely choosen, pick it */
> + devcgroup->local.behavior = devcgroup->behavior;
> + break;
> case DEVCG_DENY:
> /*
> * If the default policy is to deny by default, try to remove
> @@ -621,13 +786,22 @@ return 0;
> */
> if (devcgroup->behavior == DEVCG_DEFAULT_DENY) {
> dev_exception_rm(devcgroup, &ex);
> - return 0;
> + rc = propagate_exception(devcgroup);
> + return rc;
> }
> - return dev_exception_add(devcgroup, &ex);
> + rc = dev_exception_add(devcgroup, &ex);
> + if (rc)
> + return rc;
> + /* we only propagate new restrictions */
> + rc = propagate_exception(devcgroup);
> + if (!rc)
> + /* if a local behavior wasn't explicitely choosen, pick it */
> + devcgroup->local.behavior = devcgroup->behavior;
> + break;



\
 
 \ /
  Last update: 2013-01-31 06:21    [W:1.571 / U:1.844 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site