summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLi Zefan <lizf@cn.fujitsu.com>2008-07-13 12:14:04 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2008-07-13 12:51:18 -0700
commitec229e830060091b9be63c8f873c1b2407a82821 (patch)
tree505231f1cad4a3258d509dfc75e47ed445647ff6
parent17d213f806dad629e9af36fc45f082b87ed7bceb (diff)
downloadlinux-ec229e830060091b9be63c8f873c1b2407a82821.tar.gz
linux-ec229e830060091b9be63c8f873c1b2407a82821.tar.bz2
linux-ec229e830060091b9be63c8f873c1b2407a82821.zip
devcgroup: fix permission check when adding entry to child cgroup
# cat devices.list c 1:3 r # echo 'c 1:3 w' > sub/devices.allow # cat sub/devices.list c 1:3 w As illustrated, the parent group has no write permission to /dev/null, so it's child should not be allowed to add this write permission. Signed-off-by: Li Zefan <lizf@cn.fujitsu.com> Acked-by: Serge Hallyn <serue@us.ibm.com> Cc: Serge Hallyn <serue@us.ibm.com> Cc: Paul Menage <menage@google.com> Cc: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--security/device_cgroup.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index 1e2e28afba45..ddd92cec78ed 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -300,7 +300,7 @@ static int may_access_whitelist(struct dev_cgroup *c,
continue;
if (whitem->minor != ~0 && whitem->minor != refwh->minor)
continue;
- if (refwh->access & (~(whitem->access | ACC_MASK)))
+ if (refwh->access & (~whitem->access))
continue;
return 1;
}