diff options
| author | Li Zefan <lizf@cn.fujitsu.com> | 2008-07-13 12:14:04 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2008-07-13 12:51:18 -0700 |
| commit | ec229e830060091b9be63c8f873c1b2407a82821 (patch) | |
| tree | 505231f1cad4a3258d509dfc75e47ed445647ff6 | |
| parent | 17d213f806dad629e9af36fc45f082b87ed7bceb (diff) | |
| download | linux-ec229e830060091b9be63c8f873c1b2407a82821.tar.gz | |
devcgroup: fix permission check when adding entry to child cgroup
# cat devices.list c 1:3 r # echo 'c 1:3 w' > sub/devices.allow # cat sub/devices.list c 1:3 w As illustrated, the parent group has no write permission to /dev/null, so it's child should not be allowed to add this write permission. Signed-off-by: Li Zefan <lizf@cn.fujitsu.com> Acked-by: Serge Hallyn <serue@us.ibm.com> Cc: Serge Hallyn <serue@us.ibm.com> Cc: Paul Menage <menage@google.com> Cc: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| -rw-r--r-- | security/device_cgroup.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/security/device_cgroup.c b/security/device_cgroup.c index 1e2e28afba45..ddd92cec78ed 100644 --- a/security/device_cgroup.c +++ b/security/device_cgroup.c @@ -300,7 +300,7 @@ static int may_access_whitelist(struct dev_cgroup *c, continue; if (whitem->minor != ~0 && whitem->minor != refwh->minor) continue; - if (refwh->access & (~(whitem->access | ACC_MASK))) + if (refwh->access & (~whitem->access)) continue; return 1; } |