Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932449AbZAOUQO (ORCPT ); Thu, 15 Jan 2009 15:16:14 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1765991AbZAOUAw (ORCPT ); Thu, 15 Jan 2009 15:00:52 -0500 Received: from kroah.org ([198.145.64.141]:48984 "EHLO coco.kroah.org" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1762658AbZAOUAk (ORCPT ); Thu, 15 Jan 2009 15:00:40 -0500 Date: Thu, 15 Jan 2009 11:58:09 -0800 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: Justin Forbes , Zwane Mwaikambo , "Theodore Ts'o" , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , Willy Tarreau , Rodrigo Rubira Branco , Jake Edge , Eugene Teo , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, "Serge E. Hallyn" , Li Zefan , Pavel Emelyanov , Paul Menage , Lai Jiangshan , KOSAKI Motohiro , James Morris Subject: [patch 25/94] devices cgroup: allow mkfifo Message-ID: <20090115195809.GY14419@kroah.com> References: <20090115194806.804618825@mini.kroah.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline; filename="devices-cgroup-allow-mkfifo.patch" In-Reply-To: <20090115195520.GA14403@kroah.com> User-Agent: Mutt/1.5.16 (2007-06-09) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1776 Lines: 51 2.6.28-stable review patch. If anyone has any objections, please let us know. ------------------ From: Serge E. Hallyn commit 0b82ac37b889ec881b645860da3775118effb3ca upstream. The devcgroup_inode_permission() hook in the devices whitelist cgroup has always bypassed access checks on fifos. But the mknod hook did not. The devices whitelist is only about block and char devices, and fifos can't even be added to the whitelist, so fifos can't be created at all except by tasks which have 'a' in their whitelist (meaning they have access to all devices). Fix the behavior by bypassing access checks to mkfifo. Signed-off-by: Serge E. Hallyn Cc: Li Zefan Cc: Pavel Emelyanov Cc: Paul Menage Cc: Lai Jiangshan Cc: KOSAKI Motohiro Cc: James Morris Reported-by: Daniel Lezcano Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- security/device_cgroup.c | 3 +++ 1 file changed, 3 insertions(+) --- a/security/device_cgroup.c +++ b/security/device_cgroup.c @@ -513,6 +513,9 @@ int devcgroup_inode_mknod(int mode, dev_ struct dev_cgroup *dev_cgroup; struct dev_whitelist_item *wh; + if (!S_ISBLK(mode) && !S_ISCHR(mode)) + return 0; + rcu_read_lock(); dev_cgroup = task_devcgroup(current); -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/