diff options
| author | Serge Hallyn <serge.hallyn@ubuntu.com> | 2013-10-22 23:34:00 (GMT) |
|---|---|---|
| committer | Matthew Weigel <Matthew.Weigel@freescale.com> | 2014-12-11 18:40:06 (GMT) |
| commit | 21061227575e90b6b4ac41f9847c1dd381181b66 (patch) | |
| tree | c1caf583efc556e1d81e050fc45a39f742fdfce7 /security | |
| parent | 5050feba3979d427ca09224422600b67ec0953c3 (diff) | |
| download | linux-fsl-qoriq-21061227575e90b6b4ac41f9847c1dd381181b66.tar.xz | |
device_cgroup: remove can_attach
It is really only wanting to duplicate a check which is already done by the
cgroup subsystem.
With this patch, user jdoe still cannot move pid 1 into a devices cgroup
he owns, but now he can move his own other tasks into devices cgroups.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Aristeu Rozanski <aris@redhat.com>
(cherry picked from commit 73ba353471e0b692f398f3d63018b7f46ccf1d3e)
Change-Id: I34af7b6399d1219cfdaf41746685bf9955e47dd7
Reviewed-on: http://git.am.freescale.net:8181/21804
Tested-by: Review Code-CDREVIEW <CDREVIEW@freescale.com>
Reviewed-by: Mihai Caraman <mihai.caraman@freescale.com>
Reviewed-by: Matthew Weigel <Matthew.Weigel@freescale.com>
Diffstat (limited to 'security')
| -rw-r--r-- | security/device_cgroup.c | 11 |
1 files changed, 0 insertions, 11 deletions
diff --git a/security/device_cgroup.c b/security/device_cgroup.c index c123628..7c2a0a7 100644 --- a/security/device_cgroup.c +++ b/security/device_cgroup.c @@ -63,16 +63,6 @@ static inline struct dev_cgroup *task_devcgroup(struct task_struct *task) struct cgroup_subsys devices_subsys; -static int devcgroup_can_attach(struct cgroup_subsys_state *new_css, - struct cgroup_taskset *set) -{ - struct task_struct *task = cgroup_taskset_first(set); - - if (current != task && !capable(CAP_SYS_ADMIN)) - return -EPERM; - return 0; -} - /* * called under devcgroup_mutex */ @@ -697,7 +687,6 @@ static struct cftype dev_cgroup_files[] = { struct cgroup_subsys devices_subsys = { .name = "devices", - .can_attach = devcgroup_can_attach, .css_alloc = devcgroup_css_alloc, .css_free = devcgroup_css_free, .css_online = devcgroup_online, |