Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1496909

Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android

Show all headers | View raw

On Thu, Oct 06, 2016 at 03:43:51PM -0700, Dmitry Torokhov wrote:
> On Wed, Oct 05, 2016 at 12:18:17PM -0700, John Stultz wrote:
> > On Wed, Oct 5, 2016 at 12:10 PM, Dmitry Torokhov
> > <dmitry.torokhov@gmail.com> wrote:
> > > On Mon, Oct 03, 2016 at 09:41:30PM -0700, John Stultz wrote:
> > >> +#ifdef CONFIG_CGROUP_NICE_ATTACH
> > >> +int cgroup_nice_allow_attach(struct cgroup_taskset *tset)
> > >> +{
> > >> +     const struct cred *cred = current_cred(), *tcred;
> > >> +     struct task_struct *task;
> > >> +     struct cgroup_subsys_state *css;
> > >> +
> > >> +     if (capable(CAP_SYS_NICE))
> > >> +             return 0;
> > >> +
> > >> +     cgroup_taskset_for_each(task, css, tset) {
> > >> +             tcred = __task_cred(task);
> > >
> > > __task_cred() requires RCU lock (courtesy Ricky Z).
> > 
> > Again, hopefully this isn't an issue with the new approach, but for
> > the short term I'll see if we can get this fixed in the android tree.
> > 
> 
> Actually, it should all be simply removed from there right away, as this
> ends up being basically noop (but with all the locking violations and
> races):
> 
> cgroup_taskset_for_each() needs tasks to be placed on cset->mg_tasks
> list, but nobody does this in the ->allow_access() code path, so this
> loops always executes exactly 0 times and the whole thing is exactly
> equivalent of doing
> 
> 	return capable(CAP_SYS_NICE) ? 0 : -EACESS;
> 
> which can be done right in cgroup_procs_write_permission().

Umm, sorry, no, it actually always returns 0, regardless even of
capabilities. Permissions are indeed being relaxed ;)

-- 
Dmitry

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC][PATCH 0/2] Another pass at Android style loosening of cgroup attach permissions John Stultz <john.stultz@linaro.org> - 2016-10-04 06:50 +0200
  [PATCH 2/2] cgroup: Add a allow_attach policy for Android John Stultz <john.stultz@linaro.org> - 2016-10-04 06:50 +0200
    Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android John Stultz <john.stultz@linaro.org> - 2016-10-05 21:20 +0200
      Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-07 00:50 +0200
        Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-07 01:00 +0200
    Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-05 21:20 +0200
  [PATCH 1/2] cgroup: Add generic cgroup subsystem permission checks John Stultz <john.stultz@linaro.org> - 2016-10-04 06:50 +0200
    Re: [PATCH 1/2] cgroup: Add generic cgroup subsystem permission  checks Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-05 21:10 +0200
      Re: [PATCH 1/2] cgroup: Add generic cgroup subsystem permission checks John Stultz <john.stultz@linaro.org> - 2016-10-05 21:20 +0200
        Re: [PATCH 1/2] cgroup: Add generic cgroup subsystem permission checks Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-05 21:30 +0200
  Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 18:20 +0200
    Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions John Stultz <john.stultz@linaro.org> - 2016-10-04 20:10 +0200
    Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions John Stultz <john.stultz@linaro.org> - 2016-10-04 20:10 +0200
      Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 21:40 +0200
        Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 21:50 +0200
        Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions John Stultz <john.stultz@linaro.org> - 2016-10-04 21:50 +0200
        Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions "Serge E. Hallyn" <serge@hallyn.com> - 2016-10-04 22:20 +0200
          Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 22:40 +0200
            Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions "Serge E. Hallyn" <serge@hallyn.com> - 2016-10-04 23:30 +0200
              Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 23:40 +0200

csiph-web