Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1496901

Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android

Path csiph.com!news.mixmin.net!aioe.org!gothmog.csi.it!bofh.it!news.nic.it!robomod
From Dmitry Torokhov <dmitry.torokhov@gmail.com>
Newsgroups linux.kernel
Subject Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android
Date Fri, 07 Oct 2016 00:50:01 +0200
Message-ID <sppEd-7qB-21@gated-at.bofh.it> (permalink)
References <sopPX-648-1@gated-at.bofh.it> <sopPY-648-5@gated-at.bofh.it> <soZTr-5Rt-11@gated-at.bofh.it> <soZTr-5Rt-9@gated-at.bofh.it>
Dkim-Signature v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=HFmWwAKCpdcqfQezvEXUZ7HpKz2eju+bnTKs94Jf5as=; b=Z7w6ztGcJAOccWbv8vzHi3FrRqBX1T7KuODp2K8CPWXTiVk4zippckvxJABmNZveSl BfAJv2LeH/tc21GnQTq+gflGv8pmA9fArVeU/MCeJVBmEpYAMNmLTEeBQxGA29D/WRo0 xWlvuYiTrRv0fJfNJvZR+dXcZdRAHwUUud0YyAfses7U89AFCWsoxeE5dwK/B8tMMSv/ bF8hLCGXdHLwaQkBLvVixBNGMS+If3DeOtXZRrfmRa7MkC1awWMxYhD33PA2x8KkmGcr Wc6G4v7MVnP4qASGTX9TyRM2pa1hrrvwNe5wl5EBoBxOvoRNIRvE6eLokYWTrmtv8/d7 V5Pg==
X-Google-Dkim-Signature v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=HFmWwAKCpdcqfQezvEXUZ7HpKz2eju+bnTKs94Jf5as=; b=Qky2EW5/s3qtGmmSetMhYtSm+Vgg/YbhsHlUeYdqT38kjftDsGi2r8Its3YNZa3ztw m4XOfZaOOoIv326A5dfGPwwAxud73F1bEz5YfDhfCIgl2jTYnNJVqK3OE4ioD79uQUt/ xtkrcjkn4MyeFgb4baS4Dv6JKZhuL093MYk0FejN113CtQ5cVCXtDfx2m2PFcgZ4Wdoq BHNC8NVDDs77O5vejidolGGrClVQNbc/DMZHjeF+opmLw3NWngdW0e9gpHv+pWZkP+N3 CJhqnRneuM6QfDEJ5PoezTwhiUuUlVLnCS+shvI40/FTcRy7F09BPH+3NkPFSYkFC4iG lSFA==
X-Gm-Message-State AA6/9Rl3jKDkoKz428e99Lo4teXwcEmmks+oL72WvNlhk7Xn1gVO/x6GiN46/NT2oGizMQ==
X-Received by 10.66.97.72 with SMTP id dy8mr25538677pab.114.1475793834378; Thu, 06 Oct 2016 15:43:54 -0700 (PDT)
MIME-Version 1.0
Content-Type text/plain; charset=us-ascii
Content-Disposition inline
User-Agent Mutt/1.5.21 (2010-09-15)
Sender robomod@news.nic.it
List-ID <linux-kernel.vger.kernel.org>
X-Mailing-List linux-kernel@vger.kernel.org
Approved robomod@news.nic.it
Lines 40
Organization linux.* mail to news gateway
X-Original-Cc lkml <linux-kernel@vger.kernel.org>, Rom Lemarchand <romlem@android.com>, Tejun Heo <tj@kernel.org>, Li Zefan <lizefan@huawei.com>, Jonathan Corbet <corbet@lwn.net>, cgroups@vger.kernel.org, Android Kernel Team <kernel-team@android.com>, Colin Cross <ccross@android.com>, Dmitry Shmidt <dimitrysh@google.com>, Todd Kjos <tkjos@google.com>, Christian Poetzsch <christian.potzsch@imgtec.com>, Amit Pundir <amit.pundir@linaro.org>, Ricky Zhou <rickyz@chromium.org>
X-Original-Date Thu, 6 Oct 2016 15:43:51 -0700
X-Original-Message-ID <20161006224351.GA25887@dtor-ws>
X-Original-References <1475556090-6278-1-git-send-email-john.stultz@linaro.org> <1475556090-6278-3-git-send-email-john.stultz@linaro.org> <20161005191056.GB31873@dtor-ws> <CALAqxLXxFcLWCbSHiFFy0OEDgbnJY+2OLbgLYvypDwoQMuapHg@mail.gmail.com>
X-Original-Sender linux-kernel-owner@vger.kernel.org
Xref csiph.com linux.kernel:1496901

Show key headers only | View raw

On Wed, Oct 05, 2016 at 12:18:17PM -0700, John Stultz wrote:
> On Wed, Oct 5, 2016 at 12:10 PM, Dmitry Torokhov
> <dmitry.torokhov@gmail.com> wrote:
> > On Mon, Oct 03, 2016 at 09:41:30PM -0700, John Stultz wrote:
> >> +#ifdef CONFIG_CGROUP_NICE_ATTACH
> >> +int cgroup_nice_allow_attach(struct cgroup_taskset *tset)
> >> +{
> >> +     const struct cred *cred = current_cred(), *tcred;
> >> +     struct task_struct *task;
> >> +     struct cgroup_subsys_state *css;
> >> +
> >> +     if (capable(CAP_SYS_NICE))
> >> +             return 0;
> >> +
> >> +     cgroup_taskset_for_each(task, css, tset) {
> >> +             tcred = __task_cred(task);
> >
> > __task_cred() requires RCU lock (courtesy Ricky Z).
> 
> Again, hopefully this isn't an issue with the new approach, but for
> the short term I'll see if we can get this fixed in the android tree.
> 

Actually, it should all be simply removed from there right away, as this
ends up being basically noop (but with all the locking violations and
races):

cgroup_taskset_for_each() needs tasks to be placed on cset->mg_tasks
list, but nobody does this in the ->allow_access() code path, so this
loops always executes exactly 0 times and the whole thing is exactly
equivalent of doing

	return capable(CAP_SYS_NICE) ? 0 : -EACESS;

which can be done right in cgroup_procs_write_permission().

Thanks.

-- 
Dmitry

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC][PATCH 0/2] Another pass at Android style loosening of cgroup attach permissions John Stultz <john.stultz@linaro.org> - 2016-10-04 06:50 +0200
  [PATCH 2/2] cgroup: Add a allow_attach policy for Android John Stultz <john.stultz@linaro.org> - 2016-10-04 06:50 +0200
    Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android John Stultz <john.stultz@linaro.org> - 2016-10-05 21:20 +0200
      Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-07 00:50 +0200
        Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-07 01:00 +0200
    Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-05 21:20 +0200
  [PATCH 1/2] cgroup: Add generic cgroup subsystem permission checks John Stultz <john.stultz@linaro.org> - 2016-10-04 06:50 +0200
    Re: [PATCH 1/2] cgroup: Add generic cgroup subsystem permission  checks Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-05 21:10 +0200
      Re: [PATCH 1/2] cgroup: Add generic cgroup subsystem permission checks John Stultz <john.stultz@linaro.org> - 2016-10-05 21:20 +0200
        Re: [PATCH 1/2] cgroup: Add generic cgroup subsystem permission checks Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-05 21:30 +0200
  Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 18:20 +0200
    Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions John Stultz <john.stultz@linaro.org> - 2016-10-04 20:10 +0200
    Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions John Stultz <john.stultz@linaro.org> - 2016-10-04 20:10 +0200
      Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 21:40 +0200
        Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 21:50 +0200
        Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions John Stultz <john.stultz@linaro.org> - 2016-10-04 21:50 +0200
        Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions "Serge E. Hallyn" <serge@hallyn.com> - 2016-10-04 22:20 +0200
          Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 22:40 +0200
            Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions "Serge E. Hallyn" <serge@hallyn.com> - 2016-10-04 23:30 +0200
              Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 23:40 +0200

csiph-web