device_cgroup: add DEVCG_ prefix to ACC_* and DEV_* constants
Rename device type and access type constants defined in security/device_cgroup.c by adding the DEVCG_ prefix. The reason behind this renaming is to make them global namespace friendly, as they will be moved to the corresponding header file by following patches. Signed-off-by: Roman Gushchin <guro@fb.com> Cc: David S. Miller <davem@davemloft.net> Cc: Tejun Heo <tj@kernel.org> Cc: Alexei Starovoitov <ast@kernel.org> Cc: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
488e5b30d3
commit
67e306fdbe
|
@ -15,14 +15,14 @@
|
|||
#include <linux/rcupdate.h>
|
||||
#include <linux/mutex.h>
|
||||
|
||||
#define ACC_MKNOD 1
|
||||
#define ACC_READ 2
|
||||
#define ACC_WRITE 4
|
||||
#define ACC_MASK (ACC_MKNOD | ACC_READ | ACC_WRITE)
|
||||
#define DEVCG_ACC_MKNOD 1
|
||||
#define DEVCG_ACC_READ 2
|
||||
#define DEVCG_ACC_WRITE 4
|
||||
#define DEVCG_ACC_MASK (DEVCG_ACC_MKNOD | DEVCG_ACC_READ | DEVCG_ACC_WRITE)
|
||||
|
||||
#define DEV_BLOCK 1
|
||||
#define DEV_CHAR 2
|
||||
#define DEV_ALL 4 /* this represents all devices */
|
||||
#define DEVCG_DEV_BLOCK 1
|
||||
#define DEVCG_DEV_CHAR 2
|
||||
#define DEVCG_DEV_ALL 4 /* this represents all devices */
|
||||
|
||||
static DEFINE_MUTEX(devcgroup_mutex);
|
||||
|
||||
|
@ -246,21 +246,21 @@ static void set_access(char *acc, short access)
|
|||
{
|
||||
int idx = 0;
|
||||
memset(acc, 0, ACCLEN);
|
||||
if (access & ACC_READ)
|
||||
if (access & DEVCG_ACC_READ)
|
||||
acc[idx++] = 'r';
|
||||
if (access & ACC_WRITE)
|
||||
if (access & DEVCG_ACC_WRITE)
|
||||
acc[idx++] = 'w';
|
||||
if (access & ACC_MKNOD)
|
||||
if (access & DEVCG_ACC_MKNOD)
|
||||
acc[idx++] = 'm';
|
||||
}
|
||||
|
||||
static char type_to_char(short type)
|
||||
{
|
||||
if (type == DEV_ALL)
|
||||
if (type == DEVCG_DEV_ALL)
|
||||
return 'a';
|
||||
if (type == DEV_CHAR)
|
||||
if (type == DEVCG_DEV_CHAR)
|
||||
return 'c';
|
||||
if (type == DEV_BLOCK)
|
||||
if (type == DEVCG_DEV_BLOCK)
|
||||
return 'b';
|
||||
return 'X';
|
||||
}
|
||||
|
@ -287,10 +287,10 @@ static int devcgroup_seq_show(struct seq_file *m, void *v)
|
|||
* This way, the file remains as a "whitelist of devices"
|
||||
*/
|
||||
if (devcgroup->behavior == DEVCG_DEFAULT_ALLOW) {
|
||||
set_access(acc, ACC_MASK);
|
||||
set_access(acc, DEVCG_ACC_MASK);
|
||||
set_majmin(maj, ~0);
|
||||
set_majmin(min, ~0);
|
||||
seq_printf(m, "%c %s:%s %s\n", type_to_char(DEV_ALL),
|
||||
seq_printf(m, "%c %s:%s %s\n", type_to_char(DEVCG_DEV_ALL),
|
||||
maj, min, acc);
|
||||
} else {
|
||||
list_for_each_entry_rcu(ex, &devcgroup->exceptions, list) {
|
||||
|
@ -309,10 +309,10 @@ static int devcgroup_seq_show(struct seq_file *m, void *v)
|
|||
/**
|
||||
* match_exception - iterates the exception list trying to find a complete match
|
||||
* @exceptions: list of exceptions
|
||||
* @type: device type (DEV_BLOCK or DEV_CHAR)
|
||||
* @type: device type (DEVCG_DEV_BLOCK or DEVCG_DEV_CHAR)
|
||||
* @major: device file major number, ~0 to match all
|
||||
* @minor: device file minor number, ~0 to match all
|
||||
* @access: permission mask (ACC_READ, ACC_WRITE, ACC_MKNOD)
|
||||
* @access: permission mask (DEVCG_ACC_READ, DEVCG_ACC_WRITE, DEVCG_ACC_MKNOD)
|
||||
*
|
||||
* It is considered a complete match if an exception is found that will
|
||||
* contain the entire range of provided parameters.
|
||||
|
@ -325,9 +325,9 @@ static bool match_exception(struct list_head *exceptions, short type,
|
|||
struct dev_exception_item *ex;
|
||||
|
||||
list_for_each_entry_rcu(ex, exceptions, list) {
|
||||
if ((type & DEV_BLOCK) && !(ex->type & DEV_BLOCK))
|
||||
if ((type & DEVCG_DEV_BLOCK) && !(ex->type & DEVCG_DEV_BLOCK))
|
||||
continue;
|
||||
if ((type & DEV_CHAR) && !(ex->type & DEV_CHAR))
|
||||
if ((type & DEVCG_DEV_CHAR) && !(ex->type & DEVCG_DEV_CHAR))
|
||||
continue;
|
||||
if (ex->major != ~0 && ex->major != major)
|
||||
continue;
|
||||
|
@ -344,10 +344,10 @@ static bool match_exception(struct list_head *exceptions, short type,
|
|||
/**
|
||||
* match_exception_partial - iterates the exception list trying to find a partial match
|
||||
* @exceptions: list of exceptions
|
||||
* @type: device type (DEV_BLOCK or DEV_CHAR)
|
||||
* @type: device type (DEVCG_DEV_BLOCK or DEVCG_DEV_CHAR)
|
||||
* @major: device file major number, ~0 to match all
|
||||
* @minor: device file minor number, ~0 to match all
|
||||
* @access: permission mask (ACC_READ, ACC_WRITE, ACC_MKNOD)
|
||||
* @access: permission mask (DEVCG_ACC_READ, DEVCG_ACC_WRITE, DEVCG_ACC_MKNOD)
|
||||
*
|
||||
* It is considered a partial match if an exception's range is found to
|
||||
* contain *any* of the devices specified by provided parameters. This is
|
||||
|
@ -362,9 +362,9 @@ static bool match_exception_partial(struct list_head *exceptions, short type,
|
|||
struct dev_exception_item *ex;
|
||||
|
||||
list_for_each_entry_rcu(ex, exceptions, list) {
|
||||
if ((type & DEV_BLOCK) && !(ex->type & DEV_BLOCK))
|
||||
if ((type & DEVCG_DEV_BLOCK) && !(ex->type & DEVCG_DEV_BLOCK))
|
||||
continue;
|
||||
if ((type & DEV_CHAR) && !(ex->type & DEV_CHAR))
|
||||
if ((type & DEVCG_DEV_CHAR) && !(ex->type & DEVCG_DEV_CHAR))
|
||||
continue;
|
||||
/*
|
||||
* We must be sure that both the exception and the provided
|
||||
|
@ -647,10 +647,10 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
|
|||
}
|
||||
return 0;
|
||||
case 'b':
|
||||
ex.type = DEV_BLOCK;
|
||||
ex.type = DEVCG_DEV_BLOCK;
|
||||
break;
|
||||
case 'c':
|
||||
ex.type = DEV_CHAR;
|
||||
ex.type = DEVCG_DEV_CHAR;
|
||||
break;
|
||||
default:
|
||||
return -EINVAL;
|
||||
|
@ -703,13 +703,13 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
|
|||
for (b++, count = 0; count < 3; count++, b++) {
|
||||
switch (*b) {
|
||||
case 'r':
|
||||
ex.access |= ACC_READ;
|
||||
ex.access |= DEVCG_ACC_READ;
|
||||
break;
|
||||
case 'w':
|
||||
ex.access |= ACC_WRITE;
|
||||
ex.access |= DEVCG_ACC_WRITE;
|
||||
break;
|
||||
case 'm':
|
||||
ex.access |= ACC_MKNOD;
|
||||
ex.access |= DEVCG_ACC_MKNOD;
|
||||
break;
|
||||
case '\n':
|
||||
case '\0':
|
||||
|
@ -806,7 +806,7 @@ struct cgroup_subsys devices_cgrp_subsys = {
|
|||
* @type: device type
|
||||
* @major: device major number
|
||||
* @minor: device minor number
|
||||
* @access: combination of ACC_WRITE, ACC_READ and ACC_MKNOD
|
||||
* @access: combination of DEVCG_ACC_WRITE, DEVCG_ACC_READ and DEVCG_ACC_MKNOD
|
||||
*
|
||||
* returns 0 on success, -EPERM case the operation is not permitted
|
||||
*/
|
||||
|
@ -839,13 +839,13 @@ int __devcgroup_inode_permission(struct inode *inode, int mask)
|
|||
short type, access = 0;
|
||||
|
||||
if (S_ISBLK(inode->i_mode))
|
||||
type = DEV_BLOCK;
|
||||
type = DEVCG_DEV_BLOCK;
|
||||
if (S_ISCHR(inode->i_mode))
|
||||
type = DEV_CHAR;
|
||||
type = DEVCG_DEV_CHAR;
|
||||
if (mask & MAY_WRITE)
|
||||
access |= ACC_WRITE;
|
||||
access |= DEVCG_ACC_WRITE;
|
||||
if (mask & MAY_READ)
|
||||
access |= ACC_READ;
|
||||
access |= DEVCG_ACC_READ;
|
||||
|
||||
return __devcgroup_check_permission(type, imajor(inode), iminor(inode),
|
||||
access);
|
||||
|
@ -859,11 +859,11 @@ int devcgroup_inode_mknod(int mode, dev_t dev)
|
|||
return 0;
|
||||
|
||||
if (S_ISBLK(mode))
|
||||
type = DEV_BLOCK;
|
||||
type = DEVCG_DEV_BLOCK;
|
||||
else
|
||||
type = DEV_CHAR;
|
||||
type = DEVCG_DEV_CHAR;
|
||||
|
||||
return __devcgroup_check_permission(type, MAJOR(dev), MINOR(dev),
|
||||
ACC_MKNOD);
|
||||
DEVCG_ACC_MKNOD);
|
||||
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue