[net-next-2.6.git] / security / device_cgroup.c

/*
 * dev_cgroup.c - device cgroup subsystem
 *
 * Copyright 2007 IBM Corp
 */

#include <linux/device_cgroup.h>
#include <linux/cgroup.h>
#include <linux/ctype.h>
#include <linux/list.h>
#include <linux/uaccess.h>
#include <linux/seq_file.h>

#define ACC_MKNOD 1
#define ACC_READ  2
#define ACC_WRITE 4
#define ACC_MASK (ACC_MKNOD | ACC_READ | ACC_WRITE)

#define DEV_BLOCK 1
#define DEV_CHAR  2
#define DEV_ALL   4  /* this represents all devices */

/*
 * whitelist locking rules:
 * cgroup_lock() cannot be taken under dev_cgroup->lock.
 * dev_cgroup->lock can be taken with or without cgroup_lock().
 *
 * modifications always require cgroup_lock
 * modifications to a list which is visible require the
 *   dev_cgroup->lock *and* cgroup_lock()
 * walking the list requires dev_cgroup->lock or cgroup_lock().
 *
 * reasoning: dev_whitelist_copy() needs to kmalloc, so needs
 *   a mutex, which the cgroup_lock() is.  Since modifying
 *   a visible list requires both locks, either lock can be
 *   taken for walking the list.
 */

struct dev_whitelist_item {
	u32 major, minor;
	short type;
	short access;
	struct list_head list;
};

struct dev_cgroup {
	struct cgroup_subsys_state css;
	struct list_head whitelist;
	spinlock_t lock;
};

static inline struct dev_cgroup *css_to_devcgroup(struct cgroup_subsys_state *s)
{
	return container_of(s, struct dev_cgroup, css);
}

static inline struct dev_cgroup *cgroup_to_devcgroup(struct cgroup *cgroup)
{
	return css_to_devcgroup(cgroup_subsys_state(cgroup, devices_subsys_id));
}

struct cgroup_subsys devices_subsys;

static int devcgroup_can_attach(struct cgroup_subsys *ss,
		struct cgroup *new_cgroup, struct task_struct *task)
{
	if (current != task && !capable(CAP_SYS_ADMIN))
			return -EPERM;

	return 0;
}

/*
 * called under cgroup_lock()
 */
static int dev_whitelist_copy(struct list_head *dest, struct list_head *orig)
{
	struct dev_whitelist_item *wh, *tmp, *new;

	list_for_each_entry(wh, orig, list) {
		new = kmalloc(sizeof(*wh), GFP_KERNEL);
		if (!new)
			goto free_and_exit;
		new->major = wh->major;
		new->minor = wh->minor;
		new->type = wh->type;
		new->access = wh->access;
		list_add_tail(&new->list, dest);
	}

	return 0;

free_and_exit:
	list_for_each_entry_safe(wh, tmp, dest, list) {
		list_del(&wh->list);
		kfree(wh);
	}
	return -ENOMEM;
}

/* Stupid prototype - don't bother combining existing entries */
/*
 * called under cgroup_lock()
 * since the list is visible to other tasks, we need the spinlock also
 */
static int dev_whitelist_add(struct dev_cgroup *dev_cgroup,
			struct dev_whitelist_item *wh)
{
	struct dev_whitelist_item *whcopy, *walk;

	whcopy = kmalloc(sizeof(*whcopy), GFP_KERNEL);
	if (!whcopy)
		return -ENOMEM;

	memcpy(whcopy, wh, sizeof(*whcopy));
	spin_lock(&dev_cgroup->lock);
	list_for_each_entry(walk, &dev_cgroup->whitelist, list) {
		if (walk->type != wh->type)
			continue;
		if (walk->major != wh->major)
			continue;
		if (walk->minor != wh->minor)
			continue;

		walk->access |= wh->access;
		kfree(whcopy);
		whcopy = NULL;
	}

	if (whcopy != NULL)
		list_add_tail(&whcopy->list, &dev_cgroup->whitelist);
	spin_unlock(&dev_cgroup->lock);
	return 0;
}

/*
 * called under cgroup_lock()
 * since the list is visible to other tasks, we need the spinlock also
 */
static void dev_whitelist_rm(struct dev_cgroup *dev_cgroup,
			struct dev_whitelist_item *wh)
{
	struct dev_whitelist_item *walk, *tmp;

	spin_lock(&dev_cgroup->lock);
	list_for_each_entry_safe(walk, tmp, &dev_cgroup->whitelist, list) {
		if (walk->type == DEV_ALL)
			goto remove;
		if (walk->type != wh->type)
			continue;
		if (walk->major != ~0 && walk->major != wh->major)
			continue;
		if (walk->minor != ~0 && walk->minor != wh->minor)
			continue;

remove:
		walk->access &= ~wh->access;
		if (!walk->access) {
			list_del(&walk->list);
			kfree(walk);
		}
	}
	spin_unlock(&dev_cgroup->lock);
}

/*
 * called from kernel/cgroup.c with cgroup_lock() held.
 */
static struct cgroup_subsys_state *devcgroup_create(struct cgroup_subsys *ss,
						struct cgroup *cgroup)
{
	struct dev_cgroup *dev_cgroup, *parent_dev_cgroup;
	struct cgroup *parent_cgroup;
	int ret;

	dev_cgroup = kzalloc(sizeof(*dev_cgroup), GFP_KERNEL);
	if (!dev_cgroup)
		return ERR_PTR(-ENOMEM);
	INIT_LIST_HEAD(&dev_cgroup->whitelist);
	parent_cgroup = cgroup->parent;

	if (parent_cgroup == NULL) {
		struct dev_whitelist_item *wh;
		wh = kmalloc(sizeof(*wh), GFP_KERNEL);
		if (!wh) {
			kfree(dev_cgroup);
			return ERR_PTR(-ENOMEM);
		}
		wh->minor = wh->major = ~0;
		wh->type = DEV_ALL;
		wh->access = ACC_MKNOD | ACC_READ | ACC_WRITE;
		list_add(&wh->list, &dev_cgroup->whitelist);
	} else {
		parent_dev_cgroup = cgroup_to_devcgroup(parent_cgroup);
		ret = dev_whitelist_copy(&dev_cgroup->whitelist,
				&parent_dev_cgroup->whitelist);
		if (ret) {
			kfree(dev_cgroup);
			return ERR_PTR(ret);
		}
	}

	spin_lock_init(&dev_cgroup->lock);
	return &dev_cgroup->css;
}

static void devcgroup_destroy(struct cgroup_subsys *ss,
			struct cgroup *cgroup)
{
	struct dev_cgroup *dev_cgroup;
	struct dev_whitelist_item *wh, *tmp;

	dev_cgroup = cgroup_to_devcgroup(cgroup);
	list_for_each_entry_safe(wh, tmp, &dev_cgroup->whitelist, list) {
		list_del(&wh->list);
		kfree(wh);
	}
	kfree(dev_cgroup);
}

#define DEVCG_ALLOW 1
#define DEVCG_DENY 2
#define DEVCG_LIST 3

#define MAJMINLEN 10
#define ACCLEN 4

static void set_access(char *acc, short access)
{
	int idx = 0;
	memset(acc, 0, ACCLEN);
	if (access & ACC_READ)
		acc[idx++] = 'r';
	if (access & ACC_WRITE)
		acc[idx++] = 'w';
	if (access & ACC_MKNOD)
		acc[idx++] = 'm';
}

static char type_to_char(short type)
{
	if (type == DEV_ALL)
		return 'a';
	if (type == DEV_CHAR)
		return 'c';
	if (type == DEV_BLOCK)
		return 'b';
	return 'X';
}

static void set_majmin(char *str, unsigned m)
{
	memset(str, 0, MAJMINLEN);
	if (m == ~0)
		sprintf(str, "*");
	else
		snprintf(str, MAJMINLEN, "%d", m);
}

static int devcgroup_seq_read(struct cgroup *cgroup, struct cftype *cft,
				struct seq_file *m)
{
	struct dev_cgroup *devcgroup = cgroup_to_devcgroup(cgroup);
	struct dev_whitelist_item *wh;
	char maj[MAJMINLEN], min[MAJMINLEN], acc[ACCLEN];

	spin_lock(&devcgroup->lock);
	list_for_each_entry(wh, &devcgroup->whitelist, list) {
		set_access(acc, wh->access);
		set_majmin(maj, wh->major);
		set_majmin(min, wh->minor);
		seq_printf(m, "%c %s:%s %s\n", type_to_char(wh->type),
			   maj, min, acc);
	}
	spin_unlock(&devcgroup->lock);

	return 0;
}

/*
 * may_access_whitelist:
 * does the access granted to dev_cgroup c contain the access
 * requested in whitelist item refwh.
 * return 1 if yes, 0 if no.
 * call with c->lock held
 */
static int may_access_whitelist(struct dev_cgroup *c,
				       struct dev_whitelist_item *refwh)
{
	struct dev_whitelist_item *whitem;

	list_for_each_entry(whitem, &c->whitelist, list) {
		if (whitem->type & DEV_ALL)
			return 1;
		if ((refwh->type & DEV_BLOCK) && !(whitem->type & DEV_BLOCK))
			continue;
		if ((refwh->type & DEV_CHAR) && !(whitem->type & DEV_CHAR))
			continue;
		if (whitem->major != ~0 && whitem->major != refwh->major)
			continue;
		if (whitem->minor != ~0 && whitem->minor != refwh->minor)
			continue;
		if (refwh->access & (~(whitem->access | ACC_MASK)))
			continue;
		return 1;
	}
	return 0;
}

/*
 * parent_has_perm:
 * when adding a new allow rule to a device whitelist, the rule
 * must be allowed in the parent device
 */
static int parent_has_perm(struct cgroup *childcg,
				  struct dev_whitelist_item *wh)
{
	struct cgroup *pcg = childcg->parent;
	struct dev_cgroup *parent;
	int ret;

	if (!pcg)
		return 1;
	parent = cgroup_to_devcgroup(pcg);
	spin_lock(&parent->lock);
	ret = may_access_whitelist(parent, wh);
	spin_unlock(&parent->lock);
	return ret;
}

/*
 * Modify the whitelist using allow/deny rules.
 * CAP_SYS_ADMIN is needed for this.  It's at least separate from CAP_MKNOD
 * so we can give a container CAP_MKNOD to let it create devices but not
 * modify the whitelist.
 * It seems likely we'll want to add a CAP_CONTAINER capability to allow
 * us to also grant CAP_SYS_ADMIN to containers without giving away the
 * device whitelist controls, but for now we'll stick with CAP_SYS_ADMIN
 *
 * Taking rules away is always allowed (given CAP_SYS_ADMIN).  Granting
 * new access is only allowed if you're in the top-level cgroup, or your
 * parent cgroup has the access you're asking for.
 */
static ssize_t devcgroup_access_write(struct cgroup *cgroup, struct cftype *cft,
				struct file *file, const char __user *userbuf,
				size_t nbytes, loff_t *ppos)
{
	struct cgroup *cur_cgroup;
	struct dev_cgroup *devcgroup, *cur_devcgroup;
	int filetype = cft->private;
	char *buffer, *b;
	int retval = 0, count;
	struct dev_whitelist_item wh;

	if (!capable(CAP_SYS_ADMIN))
		return -EPERM;

	devcgroup = cgroup_to_devcgroup(cgroup);
	cur_cgroup = task_cgroup(current, devices_subsys.subsys_id);
	cur_devcgroup = cgroup_to_devcgroup(cur_cgroup);

	buffer = kmalloc(nbytes+1, GFP_KERNEL);
	if (!buffer)
		return -ENOMEM;

	if (copy_from_user(buffer, userbuf, nbytes)) {
		retval = -EFAULT;
		goto out1;
	}
	buffer[nbytes] = 0;	/* nul-terminate */

	cgroup_lock();
	if (cgroup_is_removed(cgroup)) {
		retval = -ENODEV;
		goto out2;
	}

	memset(&wh, 0, sizeof(wh));
	b = buffer;

	switch (*b) {
	case 'a':
		wh.type = DEV_ALL;
		wh.access = ACC_MASK;
		goto handle;
	case 'b':
		wh.type = DEV_BLOCK;
		break;
	case 'c':
		wh.type = DEV_CHAR;
		break;
	default:
		retval = -EINVAL;
		goto out2;
	}
	b++;
	if (!isspace(*b)) {
		retval = -EINVAL;
		goto out2;
	}
	b++;
	if (*b == '*') {
		wh.major = ~0;
		b++;
	} else if (isdigit(*b)) {
		wh.major = 0;
		while (isdigit(*b)) {
			wh.major = wh.major*10+(*b-'0');
			b++;
		}
	} else {
		retval = -EINVAL;
		goto out2;
	}
	if (*b != ':') {
		retval = -EINVAL;
		goto out2;
	}
	b++;

	/* read minor */
	if (*b == '*') {
		wh.minor = ~0;
		b++;
	} else if (isdigit(*b)) {
		wh.minor = 0;
		while (isdigit(*b)) {
			wh.minor = wh.minor*10+(*b-'0');
			b++;
		}
	} else {
		retval = -EINVAL;
		goto out2;
	}
	if (!isspace(*b)) {
		retval = -EINVAL;
		goto out2;
	}
	for (b++, count = 0; count < 3; count++, b++) {
		switch (*b) {
		case 'r':
			wh.access |= ACC_READ;
			break;
		case 'w':
			wh.access |= ACC_WRITE;
			break;
		case 'm':
			wh.access |= ACC_MKNOD;
			break;
		case '\n':
		case '\0':
			count = 3;
			break;
		default:
			retval = -EINVAL;
			goto out2;
		}
	}

handle:
	retval = 0;
	switch (filetype) {
	case DEVCG_ALLOW:
		if (!parent_has_perm(cgroup, &wh))
			retval = -EPERM;
		else
			retval = dev_whitelist_add(devcgroup, &wh);
		break;
	case DEVCG_DENY:
		dev_whitelist_rm(devcgroup, &wh);
		break;
	default:
		retval = -EINVAL;
		goto out2;
	}

	if (retval == 0)
		retval = nbytes;

out2:
	cgroup_unlock();
out1:
	kfree(buffer);
	return retval;
}

static struct cftype dev_cgroup_files[] = {
	{
		.name = "allow",
		.write  = devcgroup_access_write,
		.private = DEVCG_ALLOW,
	},
	{
		.name = "deny",
		.write = devcgroup_access_write,
		.private = DEVCG_DENY,
	},
	{
		.name = "list",
		.read_seq_string = devcgroup_seq_read,
		.private = DEVCG_LIST,
	},
};

static int devcgroup_populate(struct cgroup_subsys *ss,
				struct cgroup *cgroup)
{
	return cgroup_add_files(cgroup, ss, dev_cgroup_files,
					ARRAY_SIZE(dev_cgroup_files));
}

struct cgroup_subsys devices_subsys = {
	.name = "devices",
	.can_attach = devcgroup_can_attach,
	.create = devcgroup_create,
	.destroy  = devcgroup_destroy,
	.populate = devcgroup_populate,
	.subsys_id = devices_subsys_id,
};

int devcgroup_inode_permission(struct inode *inode, int mask)
{
	struct dev_cgroup *dev_cgroup;
	struct dev_whitelist_item *wh;

	dev_t device = inode->i_rdev;
	if (!device)
		return 0;
	if (!S_ISBLK(inode->i_mode) && !S_ISCHR(inode->i_mode))
		return 0;
	dev_cgroup = css_to_devcgroup(task_subsys_state(current,
				devices_subsys_id));
	if (!dev_cgroup)
		return 0;

	spin_lock(&dev_cgroup->lock);
	list_for_each_entry(wh, &dev_cgroup->whitelist, list) {
		if (wh->type & DEV_ALL)
			goto acc_check;
		if ((wh->type & DEV_BLOCK) && !S_ISBLK(inode->i_mode))
			continue;
		if ((wh->type & DEV_CHAR) && !S_ISCHR(inode->i_mode))
			continue;
		if (wh->major != ~0 && wh->major != imajor(inode))
			continue;
		if (wh->minor != ~0 && wh->minor != iminor(inode))
			continue;
acc_check:
		if ((mask & MAY_WRITE) && !(wh->access & ACC_WRITE))
			continue;
		if ((mask & MAY_READ) && !(wh->access & ACC_READ))
			continue;
		spin_unlock(&dev_cgroup->lock);
		return 0;
	}
	spin_unlock(&dev_cgroup->lock);

	return -EPERM;
}

int devcgroup_inode_mknod(int mode, dev_t dev)
{
	struct dev_cgroup *dev_cgroup;
	struct dev_whitelist_item *wh;

	dev_cgroup = css_to_devcgroup(task_subsys_state(current,
				devices_subsys_id));
	if (!dev_cgroup)
		return 0;

	spin_lock(&dev_cgroup->lock);
	list_for_each_entry(wh, &dev_cgroup->whitelist, list) {
		if (wh->type & DEV_ALL)
			goto acc_check;
		if ((wh->type & DEV_BLOCK) && !S_ISBLK(mode))
			continue;
		if ((wh->type & DEV_CHAR) && !S_ISCHR(mode))
			continue;
		if (wh->major != ~0 && wh->major != MAJOR(dev))
			continue;
		if (wh->minor != ~0 && wh->minor != MINOR(dev))
			continue;
acc_check:
		if (!(wh->access & ACC_MKNOD))
			continue;
		spin_unlock(&dev_cgroup->lock);
		return 0;
	}
	spin_unlock(&dev_cgroup->lock);
	return -EPERM;
}
Commit	Line	Data
08ce5f16 SH	1	/*
	2	* dev_cgroup.c - device cgroup subsystem
	3	*
	4	* Copyright 2007 IBM Corp
	5	*/
	6
	7	#include <linux/device_cgroup.h>
	8	#include <linux/cgroup.h>
	9	#include <linux/ctype.h>
	10	#include <linux/list.h>
	11	#include <linux/uaccess.h>
29486df3	12	#include <linux/seq_file.h>
08ce5f16 SH	13
	14	#define ACC_MKNOD 1
	15	#define ACC_READ 2
	16	#define ACC_WRITE 4
	17	#define ACC_MASK (ACC_MKNOD \| ACC_READ \| ACC_WRITE)
	18
	19	#define DEV_BLOCK 1
	20	#define DEV_CHAR 2
	21	#define DEV_ALL 4 /* this represents all devices */
	22
	23	/*
	24	* whitelist locking rules:
	25	* cgroup_lock() cannot be taken under dev_cgroup->lock.
	26	* dev_cgroup->lock can be taken with or without cgroup_lock().
	27	*
	28	* modifications always require cgroup_lock
	29	* modifications to a list which is visible require the
	30	* dev_cgroup->lock and cgroup_lock()
	31	* walking the list requires dev_cgroup->lock or cgroup_lock().
	32	*
	33	* reasoning: dev_whitelist_copy() needs to kmalloc, so needs
	34	* a mutex, which the cgroup_lock() is. Since modifying
	35	* a visible list requires both locks, either lock can be
	36	* taken for walking the list.
	37	*/
	38
	39	struct dev_whitelist_item {
	40	u32 major, minor;
	41	short type;
	42	short access;
	43	struct list_head list;
	44	};
	45
	46	struct dev_cgroup {
	47	struct cgroup_subsys_state css;
	48	struct list_head whitelist;
	49	spinlock_t lock;
	50	};
	51
b66862f7 PE	52	static inline struct dev_cgroup css_to_devcgroup(struct cgroup_subsys_state s)
	53	{
	54	return container_of(s, struct dev_cgroup, css);
	55	}
	56
08ce5f16 SH	57	static inline struct dev_cgroup cgroup_to_devcgroup(struct cgroup cgroup)
08ce5f16 SH	58	{
b66862f7	59	return css_to_devcgroup(cgroup_subsys_state(cgroup, devices_subsys_id));
08ce5f16 SH	60	}
	61
	62	struct cgroup_subsys devices_subsys;
	63
	64	static int devcgroup_can_attach(struct cgroup_subsys *ss,
	65	struct cgroup new_cgroup, struct task_struct task)
	66	{
	67	if (current != task && !capable(CAP_SYS_ADMIN))
	68	return -EPERM;
	69
	70	return 0;
	71	}
	72
	73	/*
	74	* called under cgroup_lock()
	75	*/
	76	static int dev_whitelist_copy(struct list_head dest, struct list_head orig)
	77	{
	78	struct dev_whitelist_item wh, tmp, *new;
	79
	80	list_for_each_entry(wh, orig, list) {
	81	new = kmalloc(sizeof(*wh), GFP_KERNEL);
	82	if (!new)
	83	goto free_and_exit;
	84	new->major = wh->major;
	85	new->minor = wh->minor;
	86	new->type = wh->type;
	87	new->access = wh->access;
	88	list_add_tail(&new->list, dest);
	89	}
	90
	91	return 0;
	92
	93	free_and_exit:
	94	list_for_each_entry_safe(wh, tmp, dest, list) {
	95	list_del(&wh->list);
	96	kfree(wh);
	97	}
	98	return -ENOMEM;
	99	}
	100
	101	/* Stupid prototype - don't bother combining existing entries */
	102	/*
	103	* called under cgroup_lock()
	104	* since the list is visible to other tasks, we need the spinlock also
	105	*/
	106	static int dev_whitelist_add(struct dev_cgroup *dev_cgroup,
	107	struct dev_whitelist_item *wh)
	108	{
d1ee2971	109	struct dev_whitelist_item whcopy, walk;
08ce5f16 SH	110
	111	whcopy = kmalloc(sizeof(*whcopy), GFP_KERNEL);
	112	if (!whcopy)
	113	return -ENOMEM;
	114
	115	memcpy(whcopy, wh, sizeof(*whcopy));
	116	spin_lock(&dev_cgroup->lock);
d1ee2971 PE	117	list_for_each_entry(walk, &dev_cgroup->whitelist, list) {
	118	if (walk->type != wh->type)
	119	continue;
	120	if (walk->major != wh->major)
	121	continue;
	122	if (walk->minor != wh->minor)
	123	continue;
	124
	125	walk->access \|= wh->access;
	126	kfree(whcopy);
	127	whcopy = NULL;
	128	}
	129
	130	if (whcopy != NULL)
	131	list_add_tail(&whcopy->list, &dev_cgroup->whitelist);
08ce5f16 SH	132	spin_unlock(&dev_cgroup->lock);
	133	return 0;
	134	}
	135
	136	/*
	137	* called under cgroup_lock()
	138	* since the list is visible to other tasks, we need the spinlock also
	139	*/
	140	static void dev_whitelist_rm(struct dev_cgroup *dev_cgroup,
	141	struct dev_whitelist_item *wh)
	142	{
	143	struct dev_whitelist_item walk, tmp;
	144
	145	spin_lock(&dev_cgroup->lock);
	146	list_for_each_entry_safe(walk, tmp, &dev_cgroup->whitelist, list) {
	147	if (walk->type == DEV_ALL)
	148	goto remove;
	149	if (walk->type != wh->type)
	150	continue;
	151	if (walk->major != ~0 && walk->major != wh->major)
	152	continue;
	153	if (walk->minor != ~0 && walk->minor != wh->minor)
	154	continue;
	155
	156	remove:
	157	walk->access &= ~wh->access;
	158	if (!walk->access) {
	159	list_del(&walk->list);
	160	kfree(walk);
	161	}
	162	}
	163	spin_unlock(&dev_cgroup->lock);
	164	}
	165
	166	/*
	167	* called from kernel/cgroup.c with cgroup_lock() held.
	168	*/
	169	static struct cgroup_subsys_state devcgroup_create(struct cgroup_subsys ss,
	170	struct cgroup *cgroup)
	171	{
	172	struct dev_cgroup dev_cgroup, parent_dev_cgroup;
	173	struct cgroup *parent_cgroup;
	174	int ret;
	175
	176	dev_cgroup = kzalloc(sizeof(*dev_cgroup), GFP_KERNEL);
	177	if (!dev_cgroup)
	178	return ERR_PTR(-ENOMEM);
	179	INIT_LIST_HEAD(&dev_cgroup->whitelist);
	180	parent_cgroup = cgroup->parent;
	181
	182	if (parent_cgroup == NULL) {
	183	struct dev_whitelist_item *wh;
	184	wh = kmalloc(sizeof(*wh), GFP_KERNEL);
	185	if (!wh) {
	186	kfree(dev_cgroup);
	187	return ERR_PTR(-ENOMEM);
	188	}
	189	wh->minor = wh->major = ~0;
	190	wh->type = DEV_ALL;
	191	wh->access = ACC_MKNOD \| ACC_READ \| ACC_WRITE;
	192	list_add(&wh->list, &dev_cgroup->whitelist);
	193	} else {
	194	parent_dev_cgroup = cgroup_to_devcgroup(parent_cgroup);
	195	ret = dev_whitelist_copy(&dev_cgroup->whitelist,
196	&parent_dev_cgroup->whitelist);
197	if (ret) {
198	kfree(dev_cgroup);
199	return ERR_PTR(ret);
200	}
201	}
202
203	spin_lock_init(&dev_cgroup->lock);
204	return &dev_cgroup->css;
205	}
206
207	static void devcgroup_destroy(struct cgroup_subsys *ss,
208	struct cgroup *cgroup)
209	{
210	struct dev_cgroup *dev_cgroup;
211	struct dev_whitelist_item wh, tmp;
212
213	dev_cgroup = cgroup_to_devcgroup(cgroup);
214	list_for_each_entry_safe(wh, tmp, &dev_cgroup->whitelist, list) {
215	list_del(&wh->list);
216	kfree(wh);
217	}
218	kfree(dev_cgroup);
219	}
220
221	#define DEVCG_ALLOW 1
222	#define DEVCG_DENY 2
29486df3 SH	223	#define DEVCG_LIST 3
	224
	225	#define MAJMINLEN 10
	226	#define ACCLEN 4
08ce5f16 SH	227
	228	static void set_access(char *acc, short access)
	229	{
	230	int idx = 0;
29486df3	231	memset(acc, 0, ACCLEN);
08ce5f16 SH	232	if (access & ACC_READ)
	233	acc[idx++] = 'r';
	234	if (access & ACC_WRITE)
	235	acc[idx++] = 'w';
	236	if (access & ACC_MKNOD)
	237	acc[idx++] = 'm';
	238	}
	239
	240	static char type_to_char(short type)
	241	{
	242	if (type == DEV_ALL)
	243	return 'a';
	244	if (type == DEV_CHAR)
	245	return 'c';
	246	if (type == DEV_BLOCK)
	247	return 'b';
	248	return 'X';
	249	}
	250
29486df3	251	static void set_majmin(char *str, unsigned m)
08ce5f16	252	{
29486df3	253	memset(str, 0, MAJMINLEN);
08ce5f16 SH	254	if (m == ~0)
	255	sprintf(str, "*");
	256	else
29486df3	257	snprintf(str, MAJMINLEN, "%d", m);
08ce5f16 SH	258	}
08ce5f16 SH	259
29486df3 SH	260	static int devcgroup_seq_read(struct cgroup cgroup, struct cftype cft,
29486df3 SH	261	struct seq_file *m)
08ce5f16	262	{
29486df3	263	struct dev_cgroup *devcgroup = cgroup_to_devcgroup(cgroup);
08ce5f16	264	struct dev_whitelist_item *wh;
29486df3	265	char maj[MAJMINLEN], min[MAJMINLEN], acc[ACCLEN];
08ce5f16 SH	266
	267	spin_lock(&devcgroup->lock);
	268	list_for_each_entry(wh, &devcgroup->whitelist, list) {
	269	set_access(acc, wh->access);
29486df3 SH	270	set_majmin(maj, wh->major);
	271	set_majmin(min, wh->minor);
	272	seq_printf(m, "%c %s:%s %s\n", type_to_char(wh->type),
	273	maj, min, acc);
08ce5f16 SH	274	}
	275	spin_unlock(&devcgroup->lock);
	276
29486df3	277	return 0;
08ce5f16 SH	278	}
	279
	280	/*
	281	* may_access_whitelist:
	282	* does the access granted to dev_cgroup c contain the access
	283	* requested in whitelist item refwh.
	284	* return 1 if yes, 0 if no.
	285	* call with c->lock held
	286	*/
	287	static int may_access_whitelist(struct dev_cgroup *c,
	288	struct dev_whitelist_item *refwh)
	289	{
	290	struct dev_whitelist_item *whitem;
	291
	292	list_for_each_entry(whitem, &c->whitelist, list) {
	293	if (whitem->type & DEV_ALL)
	294	return 1;
	295	if ((refwh->type & DEV_BLOCK) && !(whitem->type & DEV_BLOCK))
	296	continue;
	297	if ((refwh->type & DEV_CHAR) && !(whitem->type & DEV_CHAR))
	298	continue;
	299	if (whitem->major != ~0 && whitem->major != refwh->major)
	300	continue;
	301	if (whitem->minor != ~0 && whitem->minor != refwh->minor)
	302	continue;
	303	if (refwh->access & (~(whitem->access \| ACC_MASK)))
	304	continue;
	305	return 1;
	306	}
	307	return 0;
	308	}
	309
	310	/*
	311	* parent_has_perm:
	312	* when adding a new allow rule to a device whitelist, the rule
	313	* must be allowed in the parent device
	314	*/
	315	static int parent_has_perm(struct cgroup *childcg,
	316	struct dev_whitelist_item *wh)
	317	{
	318	struct cgroup *pcg = childcg->parent;
	319	struct dev_cgroup *parent;
	320	int ret;
	321
	322	if (!pcg)
	323	return 1;
	324	parent = cgroup_to_devcgroup(pcg);
	325	spin_lock(&parent->lock);
	326	ret = may_access_whitelist(parent, wh);
	327	spin_unlock(&parent->lock);
	328	return ret;
	329	}
	330
	331	/*
	332	* Modify the whitelist using allow/deny rules.
	333	* CAP_SYS_ADMIN is needed for this. It's at least separate from CAP_MKNOD
	334	* so we can give a container CAP_MKNOD to let it create devices but not
	335	* modify the whitelist.
	336	* It seems likely we'll want to add a CAP_CONTAINER capability to allow
	337	* us to also grant CAP_SYS_ADMIN to containers without giving away the
	338	* device whitelist controls, but for now we'll stick with CAP_SYS_ADMIN
	339	*
	340	* Taking rules away is always allowed (given CAP_SYS_ADMIN). Granting
	341	* new access is only allowed if you're in the top-level cgroup, or your
342	* parent cgroup has the access you're asking for.
343	*/
344	static ssize_t devcgroup_access_write(struct cgroup cgroup, struct cftype cft,
345	struct file file, const char __user userbuf,
346	size_t nbytes, loff_t *ppos)
347	{
348	struct cgroup *cur_cgroup;
349	struct dev_cgroup devcgroup, cur_devcgroup;
350	int filetype = cft->private;
351	char buffer, b;
352	int retval = 0, count;
353	struct dev_whitelist_item wh;
354
355	if (!capable(CAP_SYS_ADMIN))
356	return -EPERM;
357
358	devcgroup = cgroup_to_devcgroup(cgroup);
359	cur_cgroup = task_cgroup(current, devices_subsys.subsys_id);
360	cur_devcgroup = cgroup_to_devcgroup(cur_cgroup);
361
362	buffer = kmalloc(nbytes+1, GFP_KERNEL);
363	if (!buffer)
364	return -ENOMEM;
365
366	if (copy_from_user(buffer, userbuf, nbytes)) {
367	retval = -EFAULT;
368	goto out1;
369	}
370	buffer[nbytes] = 0; /* nul-terminate */
371
372	cgroup_lock();
373	if (cgroup_is_removed(cgroup)) {
374	retval = -ENODEV;
375	goto out2;
376	}
377
378	memset(&wh, 0, sizeof(wh));
379	b = buffer;
380
381	switch (*b) {
382	case 'a':
383	wh.type = DEV_ALL;
384	wh.access = ACC_MASK;
385	goto handle;
386	case 'b':
387	wh.type = DEV_BLOCK;
388	break;
389	case 'c':
390	wh.type = DEV_CHAR;
391	break;
392	default:
393	retval = -EINVAL;
394	goto out2;
395	}
396	b++;
397	if (!isspace(*b)) {
398	retval = -EINVAL;
399	goto out2;
400	}
401	b++;
402	if (b == '') {
403	wh.major = ~0;
404	b++;
405	} else if (isdigit(*b)) {
406	wh.major = 0;
407	while (isdigit(*b)) {
408	wh.major = wh.major10+(b-'0');
409	b++;
410	}
411	} else {
412	retval = -EINVAL;
413	goto out2;
414	}
415	if (*b != ':') {
416	retval = -EINVAL;
417	goto out2;
418	}
419	b++;
420
421	/* read minor */
422	if (b == '') {
423	wh.minor = ~0;
424	b++;
425	} else if (isdigit(*b)) {
426	wh.minor = 0;
427	while (isdigit(*b)) {
428	wh.minor = wh.minor10+(b-'0');
429	b++;
430	}
431	} else {
432	retval = -EINVAL;
433	goto out2;
434	}
435	if (!isspace(*b)) {
436	retval = -EINVAL;
437	goto out2;
438	}
439	for (b++, count = 0; count < 3; count++, b++) {
440	switch (*b) {
441	case 'r':
442	wh.access \|= ACC_READ;
443	break;
444	case 'w':
445	wh.access \|= ACC_WRITE;
446	break;
447	case 'm':
448	wh.access \|= ACC_MKNOD;
449	break;
450	case '\n':
451	case '\0':
452	count = 3;
453	break;
454	default:
455	retval = -EINVAL;
456	goto out2;
457	}
458	}
459
460	handle:
461	retval = 0;
462	switch (filetype) {
463	case DEVCG_ALLOW:
464	if (!parent_has_perm(cgroup, &wh))
465	retval = -EPERM;
466	else
467	retval = dev_whitelist_add(devcgroup, &wh);
468	break;
469	case DEVCG_DENY:
470	dev_whitelist_rm(devcgroup, &wh);
471	break;
472	default:
473	retval = -EINVAL;
474	goto out2;
475	}
476
477	if (retval == 0)
478	retval = nbytes;
479
480	out2:
481	cgroup_unlock();
482	out1:
483	kfree(buffer);
484	return retval;
485	}
486
487	static struct cftype dev_cgroup_files[] = {
488	{
489	.name = "allow",
08ce5f16 SH	490	.write = devcgroup_access_write,
	491	.private = DEVCG_ALLOW,
	492	},
	493	{
	494	.name = "deny",
	495	.write = devcgroup_access_write,
	496	.private = DEVCG_DENY,
	497	},
29486df3 SH	498	{
	499	.name = "list",
	500	.read_seq_string = devcgroup_seq_read,
	501	.private = DEVCG_LIST,
	502	},
08ce5f16 SH	503	};
	504
	505	static int devcgroup_populate(struct cgroup_subsys *ss,
	506	struct cgroup *cgroup)
	507	{
	508	return cgroup_add_files(cgroup, ss, dev_cgroup_files,
	509	ARRAY_SIZE(dev_cgroup_files));
	510	}
	511
	512	struct cgroup_subsys devices_subsys = {
	513	.name = "devices",
	514	.can_attach = devcgroup_can_attach,
	515	.create = devcgroup_create,
	516	.destroy = devcgroup_destroy,
	517	.populate = devcgroup_populate,
	518	.subsys_id = devices_subsys_id,
	519	};
	520
	521	int devcgroup_inode_permission(struct inode *inode, int mask)
	522	{
08ce5f16 SH	523	struct dev_cgroup *dev_cgroup;
	524	struct dev_whitelist_item *wh;
	525
	526	dev_t device = inode->i_rdev;
	527	if (!device)
	528	return 0;
	529	if (!S_ISBLK(inode->i_mode) && !S_ISCHR(inode->i_mode))
	530	return 0;
cc9cb219 PE	531	dev_cgroup = css_to_devcgroup(task_subsys_state(current,
cc9cb219 PE	532	devices_subsys_id));
08ce5f16 SH	533	if (!dev_cgroup)
	534	return 0;
	535
	536	spin_lock(&dev_cgroup->lock);
	537	list_for_each_entry(wh, &dev_cgroup->whitelist, list) {
	538	if (wh->type & DEV_ALL)
	539	goto acc_check;
	540	if ((wh->type & DEV_BLOCK) && !S_ISBLK(inode->i_mode))
	541	continue;
	542	if ((wh->type & DEV_CHAR) && !S_ISCHR(inode->i_mode))
	543	continue;
	544	if (wh->major != ~0 && wh->major != imajor(inode))
	545	continue;
	546	if (wh->minor != ~0 && wh->minor != iminor(inode))
	547	continue;
	548	acc_check:
	549	if ((mask & MAY_WRITE) && !(wh->access & ACC_WRITE))
	550	continue;
	551	if ((mask & MAY_READ) && !(wh->access & ACC_READ))
	552	continue;
	553	spin_unlock(&dev_cgroup->lock);
	554	return 0;
	555	}
	556	spin_unlock(&dev_cgroup->lock);
	557
	558	return -EPERM;
	559	}
	560
	561	int devcgroup_inode_mknod(int mode, dev_t dev)
	562	{
08ce5f16 SH	563	struct dev_cgroup *dev_cgroup;
	564	struct dev_whitelist_item *wh;
	565
cc9cb219 PE	566	dev_cgroup = css_to_devcgroup(task_subsys_state(current,
cc9cb219 PE	567	devices_subsys_id));
08ce5f16 SH	568	if (!dev_cgroup)
	569	return 0;
	570
	571	spin_lock(&dev_cgroup->lock);
	572	list_for_each_entry(wh, &dev_cgroup->whitelist, list) {
	573	if (wh->type & DEV_ALL)
	574	goto acc_check;
	575	if ((wh->type & DEV_BLOCK) && !S_ISBLK(mode))
	576	continue;
	577	if ((wh->type & DEV_CHAR) && !S_ISCHR(mode))
	578	continue;
	579	if (wh->major != ~0 && wh->major != MAJOR(dev))
	580	continue;
	581	if (wh->minor != ~0 && wh->minor != MINOR(dev))
	582	continue;
	583	acc_check:
	584	if (!(wh->access & ACC_MKNOD))
	585	continue;
	586	spin_unlock(&dev_cgroup->lock);
	587	return 0;
	588	}
	589	spin_unlock(&dev_cgroup->lock);
	590	return -EPERM;
	591	}