From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754771AbdKAPV3 (ORCPT ); Wed, 1 Nov 2017 11:21:29 -0400 Received: from mx0b-00082601.pphosted.com ([67.231.153.30]:43740 "EHLO mx0b-00082601.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754729AbdKAPVZ (ORCPT ); Wed, 1 Nov 2017 11:21:25 -0400 From: Roman Gushchin To: CC: Tejun Heo , Alexei Starovoitov , Daniel Borkmann , , Roman Gushchin Subject: [PATCH net-next 1/4] device_cgroup: prepare code for bpf-based device controller Date: Wed, 1 Nov 2017 11:20:34 -0400 Message-ID: <20171101152037.3288-2-guro@fb.com> X-Mailer: git-send-email 2.13.6 In-Reply-To: <20171101152037.3288-1-guro@fb.com> References: <20171101152037.3288-1-guro@fb.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [2620:10d:c091:200::3:5dcb] X-ClientProxiedBy: CO2PR04CA0099.namprd04.prod.outlook.com (2603:10b6:104:6::25) To SN2PR15MB1086.namprd15.prod.outlook.com (2603:10b6:804:22::8) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 9ca55713-75d1-4c7e-c978-08d5213c2730 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(4534020)(4602075)(2017052603199);SRVR:SN2PR15MB1086; X-Microsoft-Exchange-Diagnostics: 1;SN2PR15MB1086;3:SDKv5iyujWmZMNBSM0/kSBGIZXVwr6Ba52ER08TCBUZSHwivSdNofwZyfRSDb8POrqBA2J/9bSGb8qPFy3VaS+4X/8QBq/qk7Rj8UtZzBUVHh6XsZmLaBdj6IayUjkGdn13oEe4q8szUpeYPMXxE59mrq5VCqchIHAA2EfYV74ZQTGu2T0y3KuJngIwfnwzodHIPfW4eiMSRGcQYGbunaY0xIvW9W5e0SeuGsSMVjIGNeXrEuJWVr2k3pOE0eZ+S;25:T1mAzRacGQXKWS2kTnJgbEgethp0cQ1N2UHgGwbIVYZSTo8bBZnCx1zOtqmIm2/RmD2Vo4eZFvhKcirc/VRbJ8yv7dYVskryW4FRf7qS2tEgNt0jigMbRkHkxLyVREJMd1Tsyr+CwMbBGgqVaZdUDYkeXBiOejl0bedjU1ekiGyh+Hh8Fj3L+a5m9q1q4W3yoN2cCI2tP7Dt+y0aVJ6lAXOajb1YqaDrcwmgmRbJ/lF9wNbuHLQgtGhePvJJyHPIZN1C1xBnMYQJhG/k6jw8ss4LDGUpvt5BtSago3Hh9Adf9ORJTdGg1+sxN2wkSFXZ3Tkfh1Q599lWNBtumk6U1Q==;31:cb1UBmPHU9ql1SugTJnPMNF7BnTM+nPsYxFdwQjNByLZlQAIqgExDiavFDfa106Vb+BBmsBrpBXGwSsR8Gfm6nJIa1ANo6vIomvcqAkm9geoD6UcpmXR/krPujINW1t+AmlpZuTon0MzVk6AP/G4bXIPlxmrM1QuYXh2aWowumkc7efOQd/qx0GvByDsp9PqiK3//BJjdyl3sOfe2q1eP23abWD9TwUZjKP0Ah/bmqw= X-MS-TrafficTypeDiagnostic: SN2PR15MB1086: X-Microsoft-Exchange-Diagnostics: 1;SN2PR15MB1086;20:2LlxdW3HHN7IJMzRzIwubcHQkSoNmfkY1/li4nItQ6Dj2vOt9uGMDf8ZRVPDaBAY13ONolNWJrSTFqFHzNzvNZVwgCtHAW4d1LRDEDN8sej+LY5Hg5g+ygEWIijU02UT2jElYIBqI+VmR+I2Z7UPG4cdltIe+jrn9hL1h+u9WzCTgNBODADhPutAIEq6GeDPP3gJ8eYt07Veo64PoLB8p5scR+EBGI/WRvDif4P6jc+hxENpVt0D2Qb1ciD8uqDw3iKFybn4b1S5fuzGPo59hk6WZO1RTpSXGDbk2ePM+VKtWZzowJykpJrBCdNY1WdYxYTIOQ5pJ3jWmqjGFg1xhwxmSrFAyq96wHj4MZS8aC7TgzizyjcyPmBVVTB4snOMI0RwUIerp7B5uCerbmUdD0Kj9CvtDrTOyTLicjBIvlPI5Xx7aXrG5cTN9+IsfmlDIWx6psxCvS9fIkm7kJSRnk4Qke96b8sHNNINHjlZBqQFY5V0ixqvXOg5enG1YtmD;4:bk2rzKFfstC+kfbiQ8QDoge35p9mpiRrW4aSRqlDuMjW5jRw4HHMvJVoLSdJ7Jx6tIWfQP7m7GUiWydtxoIsuYrQwMyAF0mdVf8w6guUj5BApi/mOhvjRbgQiqQgrdUoHKCdXid280sDq/CCK5dvukjwacm4ucZG8gXwkTrhjAjl5CUQVxgVxm7VIcLF+PUrgHJOj9+PIP2uRrFu7afB0/v0hXZCUDuq7AXavpLAC29eUl18JdjeqxwSk5ywO4cRV5Y+Nd0MaaRwcXAwfhHuvwjzRJC+DxbUaGgxCSe0Wct0HWHpIZHMo5YF5u+VYaQc1oxniH8GtwBXjaCZIzZL7I45SQ0WifhAWKo8s7iygMg= X-Exchange-Antispam-Report-Test: UriScan:(192374486261705)(67672495146484); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(11241501159)(6040450)(2401047)(8121501046)(5005006)(3002001)(93006095)(93001095)(3231020)(10201501046)(100000703101)(100105400095)(6041248)(20161123560025)(20161123558100)(20161123555025)(20161123564025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123562025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:SN2PR15MB1086;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:SN2PR15MB1086; X-Forefront-PRVS: 0478C23FE0 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(6009001)(376002)(346002)(199003)(189002)(6116002)(189998001)(25786009)(6506006)(54906003)(36756003)(6666003)(86362001)(8676002)(47776003)(2950100002)(68736007)(2361001)(5660300001)(1076002)(2351001)(106356001)(33646002)(105586002)(101416001)(6916009)(8936002)(50466002)(478600001)(316002)(6512007)(48376002)(5003940100001)(53936002)(81166006)(2906002)(305945005)(50986999)(97736004)(7736002)(76176999)(53416004)(69596002)(6486002)(81156014)(4326008)(50226002)(16586007)(42262002);DIR:OUT;SFP:1102;SCL:1;SRVR:SN2PR15MB1086;H:castle.thefacebook.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;SN2PR15MB1086;23:SgRvBHto1QRl4cPXzE4CV/y+dL6zsFkCOcDZAC49/?= =?us-ascii?Q?MCBYxDzwUd47nXUnl4gt8HwsmkuKWd4ZSTZn13csgwOfDDvdegYNU/iK1LuD?= =?us-ascii?Q?wY029Dxq4xHMCAjmjjOMNc/2m2FUQU4VLXShWzvTg1SP+ddaJgw4DDNxBi+D?= =?us-ascii?Q?UZsf3S5ijxNLl7/2p6kLzzZEBdZO6IO7ITBv8U4vUIu4hrisiRXtOLAEULg5?= =?us-ascii?Q?qpMEQHMufvD+Od5anI1Zly+8niFpW6enyyjehy9gtYPNeDWJL6HQIrP8jQIe?= =?us-ascii?Q?6XCkfVS7heupyAW3QWk/KSy6GQyXKem7gs7wRIgggTA462sFSKU6fumdIsgZ?= =?us-ascii?Q?WZL6BkkN6RH0lJs4D+vChlNs2XCSGrU3fBZn+kpdyjwev9J/Ruu3HV5Mfz5w?= =?us-ascii?Q?yAG3SMOeA80dsBcE9p7b505Y+HN7qOU11MWEmQ6AL0zC7qwQ68zHMvMABBJa?= =?us-ascii?Q?wx7Yhel5QboJirEyrUuwCZsUJP6yQx6dVPs7JvCoNUmFYJf0lgoPWbBhfKaC?= =?us-ascii?Q?joAY3x+8IVY+4k2Lr/cbwCiRfY6T46nSlqP9LYqEdbBXaRzlNG08LIhE6i4p?= =?us-ascii?Q?Rxo5mf5O4yWcDIK0r2RReIYnIVSjfsaWqqfRN7DwoyIAd52dSa7M/Xo/0zEb?= =?us-ascii?Q?d8fJZM3Q4XJpiYo3ozlel7gb1AdIzTMdo23FQdN9pxgJZ25T+4d/K0hB4Dkr?= =?us-ascii?Q?Z0Zk0zvXDFZbbIJyq7d440nSKINLluyyeBexDXZJcKlXCu7wgEeOOJxDaAmm?= =?us-ascii?Q?3Vfi3mCDzFudTrcP1bCRWURIt05KABWO5tDZKIAE0u4X+V0mup8Vcxl/h27e?= =?us-ascii?Q?whpw2SVUpHy0u9On4h8w3ezvZKm3eskUjU/NTUlyuJXKGj9RtshNe0MkHN5W?= =?us-ascii?Q?U3YmVoPRWmLQQaXHTNiwQXzSOB729VQeqFKKy5DAwR5MdA8PNFtz4a4iTdvt?= =?us-ascii?Q?OMAX1kiG4DwQtLZp0gFblP78g1xrnD1CYe1UfDetZupUFFs/2KuqXz9o7eZ5?= =?us-ascii?Q?aS9ArBRYRx9wx+t/XdM8jk69yPJcOnRuM8Zh7sCagWwMJB6st78e2dTG7ci8?= =?us-ascii?Q?Wn5vvR691s64gsgzbgElTUJ41O6VvgJ0TyChpCpsrJ0Y/0yJlcFm3iEsZaRF?= =?us-ascii?Q?gP7xr6jHFbCWqCyrZwfRjg7+SnelzzI?= X-Microsoft-Exchange-Diagnostics: 1;SN2PR15MB1086;6:V8i6OVEUT9ysbrrTPS8/vTNIuElzf7RYkfQbgWBY1184j6kFBEm86zA5dEqi/U7v+2x9DLn7WO/QxgfVMQyxY1+LhUequC0INfJFka5axL4XfkHZ3z5EIgdCHm+GR2PEbCuxwv10Bu7RCg6wpSuiRxvvkTpaP70QgQtnd9wztd6vpnVdXTjOLml6QTXCQa1qTMeLzpmv62Cxk13KEQK1tcnsjjkNnXiGhupdrMPo47zEH2rs+VKXlmkcFbiyfj3Y6DKmtbXaXwivD92PW2UwW4i0/gd0SgWLgmVCKFVWkKAHOLg0QpUYtfLt8l1Q8345bi514SSaqUoyVFVY/nbWPTWkM28jsIVaMFe5c2aDK1Y=;5:MRZxsOiBC7iH0VdRmIsU71dlNrOJqtII3Rw/Y2/NXbpULbyX6wgUd/cmWWQ0As4Jg+XjlhFiASeTBfXk0OHvTFZOckk9Q3Ji6sc/+WDjsxT5LzTT3GVromcYuHLnJr2XoIx5lET8+NbeR7UqYfik/mzz7EFYgqZoawoyX55c0cA=;24:4KQDp/Tdn3WPH8P9qMomV4tH/s3lvZITBCQoonk9qWwE0k074Ld8JdA2LtijCl41F+D8I9n5ef6Ay8ELBK7+0KgYLo46hB8uAxj/34+/rEA=;7:xbgi8wrGL4OsqtDoxY5K2goAlHSwELm78/oa01vxKfEs/eOuYCjBmqGT8ClFQhx5mUEvE2YiaavQ4ymrXwC+i1A1cQ3sKmFF+DPRY/XLmwFS+7b5SMgtgZ/oO4AULk5P/4Ytw+vfKFA4/HDyp34GY2itqe8HaBeQved6sFTn6uEzO9CRBogqQYzNegVCF4RGXTAjq83YcG04fFAVlupph8kwK2Fn8nL9EGE4xb360BwqoQpKPTLmsGgAhKnwf3rS SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;SN2PR15MB1086;20:RoaegWpjFhp3waOV/FaHLO/bH5ZuFo0xU2y+QbrhWaQc66hjFrPF9roSzeEKHUMoyQ5H2jYZWQsB9f68Flt0sZ/AsT+GrfYLspj44TLnGc/zkjHJPnxfDxwYhKvfignAaTsc/h3QGSEsSU9MLNsOZ2bPfjsBlTi/ouZeg7Sbkro= X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Nov 2017 15:20:56.9868 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 9ca55713-75d1-4c7e-c978-08d5213c2730 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2 X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN2PR15MB1086 X-OriginatorOrg: fb.com X-Proofpoint-Spam-Reason: safe X-FB-Internal: Safe X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-11-01_03:,, signatures=0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This is non-functional change to prepare the device cgroup code for adding eBPF-based controller for cgroups v2. The patch performs the following changes: 1) __devcgroup_inode_permission() and devcgroup_inode_mknod() are moving to the device-cgroup.h and converting into static inline. 2) __devcgroup_check_permission() is exported. 3) devcgroup_check_permission() wrapper is introduced to be used by both existing and new bpf-based implementations. Signed-off-by: Roman Gushchin Acked-by: Tejun Heo Acked-by: Alexei Starovoitov --- include/linux/device_cgroup.h | 61 ++++++++++++++++++++++++++++++++++++++++--- security/device_cgroup.c | 47 ++------------------------------- 2 files changed, 59 insertions(+), 49 deletions(-) diff --git a/include/linux/device_cgroup.h b/include/linux/device_cgroup.h index 8b64221b432b..25f1dc7673db 100644 --- a/include/linux/device_cgroup.h +++ b/include/linux/device_cgroup.h @@ -1,16 +1,69 @@ #include +#define ACC_MKNOD 1 +#define ACC_READ 2 +#define ACC_WRITE 4 +#define ACC_MASK (ACC_MKNOD | ACC_READ | ACC_WRITE) + +#define DEV_BLOCK 1 +#define DEV_CHAR 2 +#define DEV_ALL 4 /* this represents all devices */ + +#ifdef CONFIG_CGROUP_DEVICE +extern int __devcgroup_check_permission(short type, u32 major, u32 minor, + short access); +#else +static inline int __devcgroup_check_permission(short type, u32 major, u32 minor, + short access) +{ return 0; } +#endif + #ifdef CONFIG_CGROUP_DEVICE -extern int __devcgroup_inode_permission(struct inode *inode, int mask); -extern int devcgroup_inode_mknod(int mode, dev_t dev); +static inline int devcgroup_check_permission(short type, u32 major, u32 minor, + short access) +{ + return __devcgroup_check_permission(type, major, minor, access); +} + static inline int devcgroup_inode_permission(struct inode *inode, int mask) { + short type, access = 0; + if (likely(!inode->i_rdev)) return 0; - if (!S_ISBLK(inode->i_mode) && !S_ISCHR(inode->i_mode)) + + if (S_ISBLK(inode->i_mode)) + type = DEV_BLOCK; + else if (S_ISCHR(inode->i_mode)) + type = DEV_CHAR; + else return 0; - return __devcgroup_inode_permission(inode, mask); + + if (mask & MAY_WRITE) + access |= ACC_WRITE; + if (mask & MAY_READ) + access |= ACC_READ; + + return devcgroup_check_permission(type, imajor(inode), iminor(inode), + access); } + +static inline int devcgroup_inode_mknod(int mode, dev_t dev) +{ + short type; + + if (!S_ISBLK(mode) && !S_ISCHR(mode)) + return 0; + + if (S_ISBLK(mode)) + type = DEV_BLOCK; + else + type = DEV_CHAR; + + return devcgroup_check_permission(type, MAJOR(dev), MINOR(dev), + ACC_MKNOD); +} + #else static inline int devcgroup_inode_permission(struct inode *inode, int mask) { return 0; } diff --git a/security/device_cgroup.c b/security/device_cgroup.c index 03c1652c9a1f..d6fb42274ed4 100644 --- a/security/device_cgroup.c +++ b/security/device_cgroup.c @@ -14,15 +14,6 @@ #include #include -#define ACC_MKNOD 1 -#define ACC_READ 2 -#define ACC_WRITE 4 -#define ACC_MASK (ACC_MKNOD | ACC_READ | ACC_WRITE) - -#define DEV_BLOCK 1 -#define DEV_CHAR 2 -#define DEV_ALL 4 /* this represents all devices */ - static DEFINE_MUTEX(devcgroup_mutex); enum devcg_behavior { @@ -809,8 +800,8 @@ struct cgroup_subsys devices_cgrp_subsys = { * * returns 0 on success, -EPERM case the operation is not permitted */ -static int __devcgroup_check_permission(short type, u32 major, u32 minor, - short access) +int __devcgroup_check_permission(short type, u32 major, u32 minor, + short access) { struct dev_cgroup *dev_cgroup; bool rc; @@ -832,37 +823,3 @@ static int __devcgroup_check_permission(short type, u32 major, u32 minor, return 0; } - -int __devcgroup_inode_permission(struct inode *inode, int mask) -{ - short type, access = 0; - - if (S_ISBLK(inode->i_mode)) - type = DEV_BLOCK; - if (S_ISCHR(inode->i_mode)) - type = DEV_CHAR; - if (mask & MAY_WRITE) - access |= ACC_WRITE; - if (mask & MAY_READ) - access |= ACC_READ; - - return __devcgroup_check_permission(type, imajor(inode), iminor(inode), - access); -} - -int devcgroup_inode_mknod(int mode, dev_t dev) -{ - short type; - - if (!S_ISBLK(mode) && !S_ISCHR(mode)) - return 0; - - if (S_ISBLK(mode)) - type = DEV_BLOCK; - else - type = DEV_CHAR; - - return __devcgroup_check_permission(type, MAJOR(dev), MINOR(dev), - ACC_MKNOD); - -} -- 2.13.6