From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933729AbdKBOzn (ORCPT ); Thu, 2 Nov 2017 10:55:43 -0400 Received: from mx0b-00082601.pphosted.com ([67.231.153.30]:49870 "EHLO mx0b-00082601.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933449AbdKBOzh (ORCPT ); Thu, 2 Nov 2017 10:55:37 -0400 From: Roman Gushchin To: CC: Tejun Heo , Alexei Starovoitov , Daniel Borkmann , , , Roman Gushchin Subject: [PATCH v2 net-next 2/5] device_cgroup: prepare code for bpf-based device controller Date: Thu, 2 Nov 2017 10:54:37 -0400 Message-ID: <20171102145440.12986-3-guro@fb.com> X-Mailer: git-send-email 2.13.6 In-Reply-To: <20171102145440.12986-1-guro@fb.com> References: <20171102145440.12986-1-guro@fb.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [2620:10d:c091:200::a050] X-ClientProxiedBy: BN6PR20CA0057.namprd20.prod.outlook.com (2603:10b6:404:151::19) To CO1PR15MB1077.namprd15.prod.outlook.com (2a01:111:e400:7b66::7) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 8e2ff3f7-7c6a-4fc0-8980-08d52201bdd0 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(2017052603199);SRVR:CO1PR15MB1077; X-Microsoft-Exchange-Diagnostics: 1;CO1PR15MB1077;3:l+Lso837DTzupRU1HThoRnSibOj304IkPIVjKZHhT6tRCU/PFee1+sbuyefHVfvXaTHLlVEJAvOUS5nTbj6Q2+H7XVOSVcvwhoGQL6B8X3iw+5GR31gh3Sf2c3lW6iP0GQAj2OkTQWQfv1towTf/XhCSyaBDIgbvAR8j4s0dKPL9ejjT/IXnQvOwbJ8VgPbeuQrcdQNfhK3eAw6GrMDUi/ZPAhChLPYDLH3oKy7T1jJJRDkB4wyxjoIQgww1V5R2;25:HYdWjPvESWEUBN3K2GjGAePVJ7uDvtOYdo52feTFQStPcUMZq0pjtd8MuE6uXIb+4ANpgxfVSg8zKfRg6XCnLvy98Xcb9JKqMJ2NdZqotu7LXCcduNqNrbhX1x6lIdX3iohJPqZh1qawGoaVDDDA0QrV7SzU8kiCNMdKF+ZvcTO7ssAPkrwqe594cuxEyHZ4G+bNddcfvnULRd9LFaUxfBfasQtu4I/aQ+4UX9JUiOZklbgmEhJIpg78yA0R03TkXYr2352I+cRl239kQCXbCeW4WKoAlyH3NyShhNwQQlAyYtp9UlQTxJTY64podmKAPbfW8wKKpyLcw8nkdp83Mg==;31:QLvhTUG7qmsF4tZKccACiA8jgl4XonyXfVjr54bCSxxs386Z6dKVQQCP191eQbulc4Qrw3QPW3q8h9iDQ0FXOPrqWjUgbTeFmzc60zm2YSd+o6KzUttL0hDLIyNB2dhPODy6kMDxaOMUyBFxE5+abXtCJyIhI9BLY/x+ADZGGmYP0/WCG1xTCXu5p7/ZKBMvg9W3Xa6a1Cfu+ub60uegw8TrVtlOPl5JrGCjYr4nNz0= X-MS-TrafficTypeDiagnostic: CO1PR15MB1077: X-Microsoft-Exchange-Diagnostics: 1;CO1PR15MB1077;20:X9I/EVU8Qg6DuwZIouSQm/t8ORLOm4NApLPLhp1EFhdDbERTZgJOrtLQF4p/k+JM2x9NeoJZNPSKqDZG/0FHEWS5NwZpAGHSr6iHG6DozsbQnNQHc0zUp6xomDv6nTHGGJxsXbwehj3lQk3Yw1BVfAiYCK73mZ4lFKNsGV/g6eBLEbJGHOYU7ncTR9BeMrEE2L33Zv3JX5aGYmswWz2lj6FwKn848Dv/8dzfRPGg1tzYjMCgPqusflBTWSt0xZwNmVpnueijfJoyYNg0hUkayymeupJxVbozdrR+K/nPvspRv8HWcKC59/bQfdOla8jrYCEXcD7SCRdg1er+iTVKhJ3hKC/cXfvuoaKgntWTYal73BcTkWSJYnSgJlqPVobzvMEdzXmT2S95Zkh2N5HdNRBmCafIul66p4eXcuvElDENMOuygq1/bDaAbPcDRh/2R/W+zYUwkcuZp13+XHo6RiqzzSKmEqX+oImopybaxOXgyL8Nwj7+hdZhsjEzxdzG;4:mlYACrwmCm2Z/k3OHk8RzsI02D2M92WBfHmvUj8aLeMXrpBglkT5wrHEhZvdVw3AtyrSo5Vzwh68jAbedVo97NoGq+67CseWxom6VR41ViIOT/caH642TaPaTqOoWphkBq0nLmcKI1iXNiB6YYnqNiEPEFRfifo+27j50Gljeu6mun/p1/j3ToHwIs/m787q0WB+q7JWkOVxb9CqfgsgPqyXcybG0zogaE5Fv9IQR3OQTGwiX4B+An7MVjmERTF6nn0GT2MVyEDmjTCvj15omL0Hx+qHilaTOdhdVE2lC+VySnr6IT08Kn7KBYTj41ybMITg9kgI6GkHuivV5VBEnsRVf52HrvfxTpnSD0CRcQ8= X-Exchange-Antispam-Report-Test: UriScan:(192374486261705)(67672495146484); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(11241501159)(6040450)(2401047)(5005006)(8121501046)(3231020)(93006095)(93001095)(3002001)(10201501046)(100000703101)(100105400095)(6041248)(20161123562025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123558100)(20161123555025)(20161123564025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:CO1PR15MB1077;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:CO1PR15MB1077; X-Forefront-PRVS: 047999FF16 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(6009001)(346002)(376002)(199003)(189002)(81156014)(50466002)(189998001)(48376002)(76176999)(50986999)(25786009)(4326008)(2361001)(36756003)(7736002)(5660300001)(2351001)(1076002)(8676002)(101416001)(68736007)(97736004)(33646002)(2906002)(81166006)(6666003)(6116002)(105586002)(106356001)(316002)(5003940100001)(8936002)(478600001)(54906003)(53936002)(305945005)(16586007)(2950100002)(6916009)(6486002)(47776003)(53416004)(69596002)(575784001)(86362001)(6506006)(50226002)(6512007)(42262002);DIR:OUT;SFP:1102;SCL:1;SRVR:CO1PR15MB1077;H:castle.thefacebook.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;CO1PR15MB1077;23:EUZ1qBr1Ad67DQBEv3mBxGSMH05hM1vNWUkhrOlpD?= =?us-ascii?Q?yzxpWe8bWP7PD/3+B4cgpDFKdA858JZawZ6gxNMMb94z8ZMY/+KsOgQHgIAk?= =?us-ascii?Q?khJhHBDniqzKf/+/Sbkn9Jzoj/vDf2UB9dF5ttR+NUiIxP8YbudcBWRVZ4PO?= =?us-ascii?Q?FnC5rlJv2cTIwS69R//IdOqSwjkO+VoCJWdC7TDaJ/aycbo6WMhVlTztXoHA?= =?us-ascii?Q?iB1DDX1ylK9V4xYZcXp2UqueLXpgMix95MDBJ7AQT5tV7EvO6IGbtb21N1jh?= =?us-ascii?Q?cnRIfXTXhtbYz5GTRetiYXXHjqlwjAj+wtddKUfC73tC53f/Ov4tJqzfnTIZ?= =?us-ascii?Q?wisWX4IaHw0UASCGpl94D9BBvqHEl1wxizxt/K1gvw6B5PPShLujj3dmXHHv?= =?us-ascii?Q?heFqd9hQNO9WCoLtxDSsWxwEbEnnLD2vbbVKyTS1oX3cQUx5aYfgiF2+UbtK?= =?us-ascii?Q?Az2jusaw5QTtTbb2fvhVBrC76O8yo49rVh2/2PAoS08lxf5qao9/PbyzBv+S?= =?us-ascii?Q?XwozKZjVBA6chXr6IeD1FyeEVBYdIyX5syRPh/a1Lx/eaUZJuB5025Iq3vEF?= =?us-ascii?Q?dG07BRgGPf5Ts0uj4Td0GoH9fDBVKHym3wQUYflbk8zD5oSBCssBiHEFhyvI?= =?us-ascii?Q?PiFzqrJFw6sYUtld+yEuYi7oCbECpt7lHWJvg4PMXXmnnuVIt/xJlMxiGKkn?= =?us-ascii?Q?H5gH2vpAf5xpNtI6sLIEKghBEPMINAfWLadpli3GECifKBo5eQy9Etzsp+V9?= =?us-ascii?Q?5EA3R183DMnrSIArZT6hEicBH9X/FI9v3VLu8HPvN+54sorSQaZ1tav+U68t?= =?us-ascii?Q?gTuD41OpYOCDfjg2JJLcUm8+1QIsBbfv9z+y07/LH/Zf0v4hE2iAChErL1E0?= =?us-ascii?Q?kamE6RblWKR8p1sMTU21hdxN13/h1RGewi2QySZOfVi+PU4PK7+IIXnYGlKW?= =?us-ascii?Q?PYkyoutQqIPk9mL3vXfLYwetWVCmJjGGVibg94mRn77HcNRNMzIk306NiRZj?= =?us-ascii?Q?ngd5XRavz4SJVivlJ+jsMqOAmSBLYqm6OivAwR7pOq9vt3knBo0PMd6onFM5?= =?us-ascii?Q?luGTjRfiVP8cdVP2afdiPKE+NatZYVOIlqihylDkuBlEpUGsBSlzCjdI+M4F?= =?us-ascii?Q?fFuoD5FQB9g9UdSUiCVHiGyT1DILkiqdxhXm0DrSKodr6zBP17iAQ=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1;CO1PR15MB1077;6:oWHrBkGkBEVE0XSV+sbO14HXYtl8qfrHTZF1dvTk4aPuuGQ3wOc8pVA4TG65Z212GS9y+wgysGX07YiPr92hPyqYZj51eZgUaA6kk+dNdjUDewLepvssOxC0yxtCYeUOb0/x+y3UM2se3c8N1wZ3ekL5FZPsZVeVUj/fW1AvJgroYMAwCDJbWXrxTls9mjhRCMntX2cyEC3iFRMB+zHI1pBQPsbn8kvNWceezMohbD3iDP9RikRJxrn6MPYLGCe4dlBPIxhVM9PGQnr5GFVp9+kmulHIs7zlfUNLR0Ib9AoIePo3kG7eLPcRbgtoWK4EPXshLd96UrbserTw4DKv6LxYa+6z5uGMEUV3uaWSNuQ=;5:kOdtzqAdCiUDnu9QlIafJKbkFA537kaaHR/UGeakbXEBBEV/LWpXNsM6f1yMxU0ZcZdkC+xtlzO1Xo2zd5cOFIxUQQIbIef2sTtVijY2ZmtQaTkUN6lKzlGGdTG8EeeuKkUiX9//malPOVS4GpNsTF06TLxbfx/NEHtBOQbFrqc=;24:rU5ZF9rAd3iQ6jHjXGpOWUOF3YTge09Hrk9w7NYoRWxDFrfV321JUq2ViTkGh+i+emzHz23/y7DfaPJQoEced6V3yRv2qpMV+V4PARLaB0M=;7:BJ+FsXTOe+1jGesANQp2TDlZ+zsYCexoaAPlyzWCH4MysIaKxTtyAHxMz/cXxjzzx18teaxTHVyvzMIRM+KUH6C0nSEkq2fUh/LxuYgmPXMiH3hw8jUdummJXLrFIiqQK4O+c8ORL+NCZzHKlpsVT72FiNcrdmooS36cY7oQeniD9insPyMk47DGqept3x5qboUnJao/AEhPE0YEdVuukZzb+lp84fQ/EOch8xYh00ltubFW8T6UwaQUr/tVDh6T SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;CO1PR15MB1077;20:BwBtVJLa6GGZ+VwAf3Ga/yk/wcoKUODw3ay9zm4vvOb54XlSCCG0JLrWr5cmhGcu/sdIj/tu/N9Q/uxFyvtM+yeOXVW57HEkm0t1nNeX3HiubqQlX8Mno9YC/GDnB2n1i/BffaIq4hthaXDp7hmK1x4IB/tbp9jTdyQ9fZhncJg= X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2017 14:55:20.1414 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 8e2ff3f7-7c6a-4fc0-8980-08d52201bdd0 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR15MB1077 X-OriginatorOrg: fb.com X-Proofpoint-Spam-Reason: safe X-FB-Internal: Safe X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-11-02_05:,, signatures=0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This is non-functional change to prepare the device cgroup code for adding eBPF-based controller for cgroups v2. The patch performs the following changes: 1) __devcgroup_inode_permission() and devcgroup_inode_mknod() are moving to the device-cgroup.h and converting into static inline. 2) __devcgroup_check_permission() is exported. 3) devcgroup_check_permission() wrapper is introduced to be used by both existing and new bpf-based implementations. Signed-off-by: Roman Gushchin Acked-by: Tejun Heo Acked-by: Alexei Starovoitov --- include/linux/device_cgroup.h | 61 ++++++++++++++++++++++++++++++++++++++++--- security/device_cgroup.c | 47 ++------------------------------- 2 files changed, 59 insertions(+), 49 deletions(-) diff --git a/include/linux/device_cgroup.h b/include/linux/device_cgroup.h index 8b64221b432b..1e42d33accbf 100644 --- a/include/linux/device_cgroup.h +++ b/include/linux/device_cgroup.h @@ -1,16 +1,69 @@ #include +#define DEVCG_ACC_MKNOD 1 +#define DEVCG_ACC_READ 2 +#define DEVCG_ACC_WRITE 4 +#define DEVCG_ACC_MASK (DEVCG_ACC_MKNOD | DEVCG_ACC_READ | DEVCG_ACC_WRITE) + +#define DEVCG_DEV_BLOCK 1 +#define DEVCG_DEV_CHAR 2 +#define DEVCG_DEV_ALL 4 /* this represents all devices */ + +#ifdef CONFIG_CGROUP_DEVICE +extern int __devcgroup_check_permission(short type, u32 major, u32 minor, + short access); +#else +static inline int __devcgroup_check_permission(short type, u32 major, u32 minor, + short access) +{ return 0; } +#endif + #ifdef CONFIG_CGROUP_DEVICE -extern int __devcgroup_inode_permission(struct inode *inode, int mask); -extern int devcgroup_inode_mknod(int mode, dev_t dev); +static inline int devcgroup_check_permission(short type, u32 major, u32 minor, + short access) +{ + return __devcgroup_check_permission(type, major, minor, access); +} + static inline int devcgroup_inode_permission(struct inode *inode, int mask) { + short type, access = 0; + if (likely(!inode->i_rdev)) return 0; - if (!S_ISBLK(inode->i_mode) && !S_ISCHR(inode->i_mode)) + + if (S_ISBLK(inode->i_mode)) + type = DEVCG_DEV_BLOCK; + else if (S_ISCHR(inode->i_mode)) + type = DEVCG_DEV_CHAR; + else return 0; - return __devcgroup_inode_permission(inode, mask); + + if (mask & MAY_WRITE) + access |= DEVCG_ACC_WRITE; + if (mask & MAY_READ) + access |= DEVCG_ACC_READ; + + return devcgroup_check_permission(type, imajor(inode), iminor(inode), + access); } + +static inline int devcgroup_inode_mknod(int mode, dev_t dev) +{ + short type; + + if (!S_ISBLK(mode) && !S_ISCHR(mode)) + return 0; + + if (S_ISBLK(mode)) + type = DEVCG_DEV_BLOCK; + else + type = DEVCG_DEV_CHAR; + + return devcgroup_check_permission(type, MAJOR(dev), MINOR(dev), + DEVCG_ACC_MKNOD); +} + #else static inline int devcgroup_inode_permission(struct inode *inode, int mask) { return 0; } diff --git a/security/device_cgroup.c b/security/device_cgroup.c index 76cc0cbbb10d..c54692208dcb 100644 --- a/security/device_cgroup.c +++ b/security/device_cgroup.c @@ -14,15 +14,6 @@ #include #include -#define DEVCG_ACC_MKNOD 1 -#define DEVCG_ACC_READ 2 -#define DEVCG_ACC_WRITE 4 -#define DEVCG_ACC_MASK (DEVCG_ACC_MKNOD | DEVCG_ACC_READ | DEVCG_ACC_WRITE) - -#define DEVCG_DEV_BLOCK 1 -#define DEVCG_DEV_CHAR 2 -#define DEVCG_DEV_ALL 4 /* this represents all devices */ - static DEFINE_MUTEX(devcgroup_mutex); enum devcg_behavior { @@ -809,8 +800,8 @@ struct cgroup_subsys devices_cgrp_subsys = { * * returns 0 on success, -EPERM case the operation is not permitted */ -static int __devcgroup_check_permission(short type, u32 major, u32 minor, - short access) +int __devcgroup_check_permission(short type, u32 major, u32 minor, + short access) { struct dev_cgroup *dev_cgroup; bool rc; @@ -832,37 +823,3 @@ static int __devcgroup_check_permission(short type, u32 major, u32 minor, return 0; } - -int __devcgroup_inode_permission(struct inode *inode, int mask) -{ - short type, access = 0; - - if (S_ISBLK(inode->i_mode)) - type = DEVCG_DEV_BLOCK; - if (S_ISCHR(inode->i_mode)) - type = DEVCG_DEV_CHAR; - if (mask & MAY_WRITE) - access |= DEVCG_ACC_WRITE; - if (mask & MAY_READ) - access |= DEVCG_ACC_READ; - - return __devcgroup_check_permission(type, imajor(inode), iminor(inode), - access); -} - -int devcgroup_inode_mknod(int mode, dev_t dev) -{ - short type; - - if (!S_ISBLK(mode) && !S_ISCHR(mode)) - return 0; - - if (S_ISBLK(mode)) - type = DEVCG_DEV_BLOCK; - else - type = DEVCG_DEV_CHAR; - - return __devcgroup_check_permission(type, MAJOR(dev), MINOR(dev), - DEVCG_ACC_MKNOD); - -} -- 2.13.6