Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1754394AbcJETLB (ORCPT <rfc822;w@1wt.eu>);
        Wed, 5 Oct 2016 15:11:01 -0400
Received: from mail-pf0-f196.google.com ([209.85.192.196]:34038 "EHLO
        mail-pf0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1752257AbcJETK7 (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Wed, 5 Oct 2016 15:10:59 -0400
Date: Wed, 5 Oct 2016 12:10:56 -0700
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
To: John Stultz <john.stultz@linaro.org>
Cc: lkml <linux-kernel@vger.kernel.org>,
        Rom Lemarchand <romlem@android.com>, Tejun Heo <tj@kernel.org>,
        Li Zefan <lizefan@huawei.com>, Jonathan Corbet <corbet@lwn.net>,
        cgroups@vger.kernel.org, Android Kernel Team <kernel-team@android.com>,
        Colin Cross <ccross@android.com>, Dmitry Shmidt <dimitrysh@google.com>,
        Todd Kjos <tkjos@google.com>,
        Christian Poetzsch <christian.potzsch@imgtec.com>,
        Amit Pundir <amit.pundir@linaro.org>, Ricky Zhou <rickyz@chromium.org>
Subject: Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android
Message-ID: <20161005191056.GB31873@dtor-ws>
References: <1475556090-6278-1-git-send-email-john.stultz@linaro.org>
 <1475556090-6278-3-git-send-email-john.stultz@linaro.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1475556090-6278-3-git-send-email-john.stultz@linaro.org>
User-Agent: Mutt/1.5.21 (2010-09-15)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 663
Lines: 30

On Mon, Oct 03, 2016 at 09:41:30PM -0700, John Stultz wrote:
> +#ifdef CONFIG_CGROUP_NICE_ATTACH
> +int cgroup_nice_allow_attach(struct cgroup_taskset *tset)
> +{
> +	const struct cred *cred = current_cred(), *tcred;
> +	struct task_struct *task;
> +	struct cgroup_subsys_state *css;
> +
> +	if (capable(CAP_SYS_NICE))
> +		return 0;
> +
> +	cgroup_taskset_for_each(task, css, tset) {
> +		tcred = __task_cred(task);

__task_cred() requires RCU lock (courtesy Ricky Z).

> +
> +		if (current != task && !uid_eq(cred->euid, tcred->uid) &&
> +		    !uid_eq(cred->euid, tcred->suid))
> +			return -EACCES;
> +	}
> +
> +	return 0;
> +}
> +#endif

Thanks.

-- 
Dmitry