Blame view
security/device_cgroup.c
11.4 KB
08ce5f16e cgroups: implemen... |
1 |
/* |
47c59803b devcgroup: remove... |
2 |
* device_cgroup.c - device cgroup subsystem |
08ce5f16e cgroups: implemen... |
3 4 5 6 7 8 9 10 11 |
* * Copyright 2007 IBM Corp */ #include <linux/device_cgroup.h> #include <linux/cgroup.h> #include <linux/ctype.h> #include <linux/list.h> #include <linux/uaccess.h> |
29486df32 cgroups: introduc... |
12 |
#include <linux/seq_file.h> |
5a0e3ad6a include cleanup: ... |
13 |
#include <linux/slab.h> |
47c59803b devcgroup: remove... |
14 |
#include <linux/rcupdate.h> |
b4046f00e devcgroup: avoid ... |
15 |
#include <linux/mutex.h> |
08ce5f16e cgroups: implemen... |
16 17 18 19 20 21 22 23 24 |
#define ACC_MKNOD 1 #define ACC_READ 2 #define ACC_WRITE 4 #define ACC_MASK (ACC_MKNOD | ACC_READ | ACC_WRITE) #define DEV_BLOCK 1 #define DEV_CHAR 2 #define DEV_ALL 4 /* this represents all devices */ |
b4046f00e devcgroup: avoid ... |
25 |
static DEFINE_MUTEX(devcgroup_mutex); |
08ce5f16e cgroups: implemen... |
26 27 |
/* * whitelist locking rules: |
b4046f00e devcgroup: avoid ... |
28 |
* hold devcgroup_mutex for update/read. |
47c59803b devcgroup: remove... |
29 |
* hold rcu_read_lock() for read. |
08ce5f16e cgroups: implemen... |
30 31 32 33 34 35 36 |
*/ struct dev_whitelist_item { u32 major, minor; short type; short access; struct list_head list; |
4efd1a1b2 devcgroup: relax ... |
37 |
struct rcu_head rcu; |
08ce5f16e cgroups: implemen... |
38 39 40 41 42 |
}; struct dev_cgroup { struct cgroup_subsys_state css; struct list_head whitelist; |
08ce5f16e cgroups: implemen... |
43 |
}; |
b66862f76 devcgroup: make a... |
44 45 46 47 |
static inline struct dev_cgroup *css_to_devcgroup(struct cgroup_subsys_state *s) { return container_of(s, struct dev_cgroup, css); } |
08ce5f16e cgroups: implemen... |
48 49 |
static inline struct dev_cgroup *cgroup_to_devcgroup(struct cgroup *cgroup) { |
b66862f76 devcgroup: make a... |
50 |
return css_to_devcgroup(cgroup_subsys_state(cgroup, devices_subsys_id)); |
08ce5f16e cgroups: implemen... |
51 |
} |
f92523e3a cgroup files: con... |
52 53 54 55 |
static inline struct dev_cgroup *task_devcgroup(struct task_struct *task) { return css_to_devcgroup(task_subsys_state(task, devices_subsys_id)); } |
08ce5f16e cgroups: implemen... |
56 57 58 |
struct cgroup_subsys devices_subsys; static int devcgroup_can_attach(struct cgroup_subsys *ss, |
f780bdb7c cgroups: add per-... |
59 |
struct cgroup *new_cgroup, struct task_struct *task) |
08ce5f16e cgroups: implemen... |
60 61 62 63 64 65 66 67 |
{ if (current != task && !capable(CAP_SYS_ADMIN)) return -EPERM; return 0; } /* |
b4046f00e devcgroup: avoid ... |
68 |
* called under devcgroup_mutex |
08ce5f16e cgroups: implemen... |
69 70 71 72 73 74 |
*/ static int dev_whitelist_copy(struct list_head *dest, struct list_head *orig) { struct dev_whitelist_item *wh, *tmp, *new; list_for_each_entry(wh, orig, list) { |
2cdc7241a devcgroup: use km... |
75 |
new = kmemdup(wh, sizeof(*wh), GFP_KERNEL); |
08ce5f16e cgroups: implemen... |
76 77 |
if (!new) goto free_and_exit; |
08ce5f16e cgroups: implemen... |
78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 |
list_add_tail(&new->list, dest); } return 0; free_and_exit: list_for_each_entry_safe(wh, tmp, dest, list) { list_del(&wh->list); kfree(wh); } return -ENOMEM; } /* Stupid prototype - don't bother combining existing entries */ /* |
b4046f00e devcgroup: avoid ... |
93 |
* called under devcgroup_mutex |
08ce5f16e cgroups: implemen... |
94 95 96 97 |
*/ static int dev_whitelist_add(struct dev_cgroup *dev_cgroup, struct dev_whitelist_item *wh) { |
d1ee2971f devscgroup: make ... |
98 |
struct dev_whitelist_item *whcopy, *walk; |
08ce5f16e cgroups: implemen... |
99 |
|
2cdc7241a devcgroup: use km... |
100 |
whcopy = kmemdup(wh, sizeof(*wh), GFP_KERNEL); |
08ce5f16e cgroups: implemen... |
101 102 |
if (!whcopy) return -ENOMEM; |
d1ee2971f devscgroup: make ... |
103 104 105 106 107 108 109 110 111 112 113 114 115 116 |
list_for_each_entry(walk, &dev_cgroup->whitelist, list) { if (walk->type != wh->type) continue; if (walk->major != wh->major) continue; if (walk->minor != wh->minor) continue; walk->access |= wh->access; kfree(whcopy); whcopy = NULL; } if (whcopy != NULL) |
4efd1a1b2 devcgroup: relax ... |
117 |
list_add_tail_rcu(&whcopy->list, &dev_cgroup->whitelist); |
08ce5f16e cgroups: implemen... |
118 119 120 121 |
return 0; } /* |
b4046f00e devcgroup: avoid ... |
122 |
* called under devcgroup_mutex |
08ce5f16e cgroups: implemen... |
123 124 125 126 127 |
*/ static void dev_whitelist_rm(struct dev_cgroup *dev_cgroup, struct dev_whitelist_item *wh) { struct dev_whitelist_item *walk, *tmp; |
08ce5f16e cgroups: implemen... |
128 129 130 131 132 133 134 135 136 137 138 139 140 |
list_for_each_entry_safe(walk, tmp, &dev_cgroup->whitelist, list) { if (walk->type == DEV_ALL) goto remove; if (walk->type != wh->type) continue; if (walk->major != ~0 && walk->major != wh->major) continue; if (walk->minor != ~0 && walk->minor != wh->minor) continue; remove: walk->access &= ~wh->access; if (!walk->access) { |
4efd1a1b2 devcgroup: relax ... |
141 |
list_del_rcu(&walk->list); |
6034f7e60 security,rcu: Con... |
142 |
kfree_rcu(walk, rcu); |
08ce5f16e cgroups: implemen... |
143 144 |
} } |
08ce5f16e cgroups: implemen... |
145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 |
} /* * called from kernel/cgroup.c with cgroup_lock() held. */ static struct cgroup_subsys_state *devcgroup_create(struct cgroup_subsys *ss, struct cgroup *cgroup) { struct dev_cgroup *dev_cgroup, *parent_dev_cgroup; struct cgroup *parent_cgroup; int ret; dev_cgroup = kzalloc(sizeof(*dev_cgroup), GFP_KERNEL); if (!dev_cgroup) return ERR_PTR(-ENOMEM); INIT_LIST_HEAD(&dev_cgroup->whitelist); parent_cgroup = cgroup->parent; if (parent_cgroup == NULL) { struct dev_whitelist_item *wh; wh = kmalloc(sizeof(*wh), GFP_KERNEL); if (!wh) { kfree(dev_cgroup); return ERR_PTR(-ENOMEM); } wh->minor = wh->major = ~0; wh->type = DEV_ALL; |
7759fc9d1 devcgroup: code c... |
172 |
wh->access = ACC_MASK; |
08ce5f16e cgroups: implemen... |
173 174 175 |
list_add(&wh->list, &dev_cgroup->whitelist); } else { parent_dev_cgroup = cgroup_to_devcgroup(parent_cgroup); |
b4046f00e devcgroup: avoid ... |
176 |
mutex_lock(&devcgroup_mutex); |
08ce5f16e cgroups: implemen... |
177 178 |
ret = dev_whitelist_copy(&dev_cgroup->whitelist, &parent_dev_cgroup->whitelist); |
b4046f00e devcgroup: avoid ... |
179 |
mutex_unlock(&devcgroup_mutex); |
08ce5f16e cgroups: implemen... |
180 181 182 183 184 |
if (ret) { kfree(dev_cgroup); return ERR_PTR(ret); } } |
08ce5f16e cgroups: implemen... |
185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 |
return &dev_cgroup->css; } static void devcgroup_destroy(struct cgroup_subsys *ss, struct cgroup *cgroup) { struct dev_cgroup *dev_cgroup; struct dev_whitelist_item *wh, *tmp; dev_cgroup = cgroup_to_devcgroup(cgroup); list_for_each_entry_safe(wh, tmp, &dev_cgroup->whitelist, list) { list_del(&wh->list); kfree(wh); } kfree(dev_cgroup); } #define DEVCG_ALLOW 1 #define DEVCG_DENY 2 |
29486df32 cgroups: introduc... |
204 |
#define DEVCG_LIST 3 |
17d213f80 devcgroup: always... |
205 |
#define MAJMINLEN 13 |
29486df32 cgroups: introduc... |
206 |
#define ACCLEN 4 |
08ce5f16e cgroups: implemen... |
207 208 209 210 |
static void set_access(char *acc, short access) { int idx = 0; |
29486df32 cgroups: introduc... |
211 |
memset(acc, 0, ACCLEN); |
08ce5f16e cgroups: implemen... |
212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 |
if (access & ACC_READ) acc[idx++] = 'r'; if (access & ACC_WRITE) acc[idx++] = 'w'; if (access & ACC_MKNOD) acc[idx++] = 'm'; } static char type_to_char(short type) { if (type == DEV_ALL) return 'a'; if (type == DEV_CHAR) return 'c'; if (type == DEV_BLOCK) return 'b'; return 'X'; } |
29486df32 cgroups: introduc... |
230 |
static void set_majmin(char *str, unsigned m) |
08ce5f16e cgroups: implemen... |
231 |
{ |
08ce5f16e cgroups: implemen... |
232 |
if (m == ~0) |
7759fc9d1 devcgroup: code c... |
233 |
strcpy(str, "*"); |
08ce5f16e cgroups: implemen... |
234 |
else |
7759fc9d1 devcgroup: code c... |
235 |
sprintf(str, "%u", m); |
08ce5f16e cgroups: implemen... |
236 |
} |
29486df32 cgroups: introduc... |
237 238 |
static int devcgroup_seq_read(struct cgroup *cgroup, struct cftype *cft, struct seq_file *m) |
08ce5f16e cgroups: implemen... |
239 |
{ |
29486df32 cgroups: introduc... |
240 |
struct dev_cgroup *devcgroup = cgroup_to_devcgroup(cgroup); |
08ce5f16e cgroups: implemen... |
241 |
struct dev_whitelist_item *wh; |
29486df32 cgroups: introduc... |
242 |
char maj[MAJMINLEN], min[MAJMINLEN], acc[ACCLEN]; |
08ce5f16e cgroups: implemen... |
243 |
|
4efd1a1b2 devcgroup: relax ... |
244 245 |
rcu_read_lock(); list_for_each_entry_rcu(wh, &devcgroup->whitelist, list) { |
08ce5f16e cgroups: implemen... |
246 |
set_access(acc, wh->access); |
29486df32 cgroups: introduc... |
247 248 249 250 251 |
set_majmin(maj, wh->major); set_majmin(min, wh->minor); seq_printf(m, "%c %s:%s %s ", type_to_char(wh->type), maj, min, acc); |
08ce5f16e cgroups: implemen... |
252 |
} |
4efd1a1b2 devcgroup: relax ... |
253 |
rcu_read_unlock(); |
08ce5f16e cgroups: implemen... |
254 |
|
29486df32 cgroups: introduc... |
255 |
return 0; |
08ce5f16e cgroups: implemen... |
256 257 258 259 260 261 262 |
} /* * may_access_whitelist: * does the access granted to dev_cgroup c contain the access * requested in whitelist item refwh. * return 1 if yes, 0 if no. |
b4046f00e devcgroup: avoid ... |
263 |
* call with devcgroup_mutex held |
08ce5f16e cgroups: implemen... |
264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 |
*/ static int may_access_whitelist(struct dev_cgroup *c, struct dev_whitelist_item *refwh) { struct dev_whitelist_item *whitem; list_for_each_entry(whitem, &c->whitelist, list) { if (whitem->type & DEV_ALL) return 1; if ((refwh->type & DEV_BLOCK) && !(whitem->type & DEV_BLOCK)) continue; if ((refwh->type & DEV_CHAR) && !(whitem->type & DEV_CHAR)) continue; if (whitem->major != ~0 && whitem->major != refwh->major) continue; if (whitem->minor != ~0 && whitem->minor != refwh->minor) continue; |
ec229e830 devcgroup: fix pe... |
281 |
if (refwh->access & (~whitem->access)) |
08ce5f16e cgroups: implemen... |
282 283 284 285 286 287 288 289 290 291 292 |
continue; return 1; } return 0; } /* * parent_has_perm: * when adding a new allow rule to a device whitelist, the rule * must be allowed in the parent device */ |
f92523e3a cgroup files: con... |
293 |
static int parent_has_perm(struct dev_cgroup *childcg, |
08ce5f16e cgroups: implemen... |
294 295 |
struct dev_whitelist_item *wh) { |
f92523e3a cgroup files: con... |
296 |
struct cgroup *pcg = childcg->css.cgroup->parent; |
08ce5f16e cgroups: implemen... |
297 |
struct dev_cgroup *parent; |
08ce5f16e cgroups: implemen... |
298 299 300 301 |
if (!pcg) return 1; parent = cgroup_to_devcgroup(pcg); |
47c59803b devcgroup: remove... |
302 |
return may_access_whitelist(parent, wh); |
08ce5f16e cgroups: implemen... |
303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 |
} /* * Modify the whitelist using allow/deny rules. * CAP_SYS_ADMIN is needed for this. It's at least separate from CAP_MKNOD * so we can give a container CAP_MKNOD to let it create devices but not * modify the whitelist. * It seems likely we'll want to add a CAP_CONTAINER capability to allow * us to also grant CAP_SYS_ADMIN to containers without giving away the * device whitelist controls, but for now we'll stick with CAP_SYS_ADMIN * * Taking rules away is always allowed (given CAP_SYS_ADMIN). Granting * new access is only allowed if you're in the top-level cgroup, or your * parent cgroup has the access you're asking for. */ |
f92523e3a cgroup files: con... |
318 319 |
static int devcgroup_update_access(struct dev_cgroup *devcgroup, int filetype, const char *buffer) |
08ce5f16e cgroups: implemen... |
320 |
{ |
f92523e3a cgroup files: con... |
321 |
const char *b; |
7759fc9d1 devcgroup: code c... |
322 |
char *endp; |
c012a54ae devcgroup: remove... |
323 |
int count; |
08ce5f16e cgroups: implemen... |
324 325 326 327 |
struct dev_whitelist_item wh; if (!capable(CAP_SYS_ADMIN)) return -EPERM; |
08ce5f16e cgroups: implemen... |
328 329 330 331 332 333 334 |
memset(&wh, 0, sizeof(wh)); b = buffer; switch (*b) { case 'a': wh.type = DEV_ALL; wh.access = ACC_MASK; |
d823f6bfe devcgroup: fix od... |
335 336 |
wh.major = ~0; wh.minor = ~0; |
08ce5f16e cgroups: implemen... |
337 338 339 340 341 342 343 344 |
goto handle; case 'b': wh.type = DEV_BLOCK; break; case 'c': wh.type = DEV_CHAR; break; default: |
f92523e3a cgroup files: con... |
345 |
return -EINVAL; |
08ce5f16e cgroups: implemen... |
346 347 |
} b++; |
f92523e3a cgroup files: con... |
348 349 |
if (!isspace(*b)) return -EINVAL; |
08ce5f16e cgroups: implemen... |
350 351 352 353 354 |
b++; if (*b == '*') { wh.major = ~0; b++; } else if (isdigit(*b)) { |
7759fc9d1 devcgroup: code c... |
355 356 |
wh.major = simple_strtoul(b, &endp, 10); b = endp; |
08ce5f16e cgroups: implemen... |
357 |
} else { |
f92523e3a cgroup files: con... |
358 |
return -EINVAL; |
08ce5f16e cgroups: implemen... |
359 |
} |
f92523e3a cgroup files: con... |
360 361 |
if (*b != ':') return -EINVAL; |
08ce5f16e cgroups: implemen... |
362 363 364 365 366 367 368 |
b++; /* read minor */ if (*b == '*') { wh.minor = ~0; b++; } else if (isdigit(*b)) { |
7759fc9d1 devcgroup: code c... |
369 370 |
wh.minor = simple_strtoul(b, &endp, 10); b = endp; |
08ce5f16e cgroups: implemen... |
371 |
} else { |
f92523e3a cgroup files: con... |
372 |
return -EINVAL; |
08ce5f16e cgroups: implemen... |
373 |
} |
f92523e3a cgroup files: con... |
374 375 |
if (!isspace(*b)) return -EINVAL; |
08ce5f16e cgroups: implemen... |
376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 |
for (b++, count = 0; count < 3; count++, b++) { switch (*b) { case 'r': wh.access |= ACC_READ; break; case 'w': wh.access |= ACC_WRITE; break; case 'm': wh.access |= ACC_MKNOD; break; case ' ': case '\0': count = 3; break; default: |
f92523e3a cgroup files: con... |
393 |
return -EINVAL; |
08ce5f16e cgroups: implemen... |
394 395 396 397 |
} } handle: |
08ce5f16e cgroups: implemen... |
398 399 |
switch (filetype) { case DEVCG_ALLOW: |
f92523e3a cgroup files: con... |
400 401 402 |
if (!parent_has_perm(devcgroup, &wh)) return -EPERM; return dev_whitelist_add(devcgroup, &wh); |
08ce5f16e cgroups: implemen... |
403 404 405 406 |
case DEVCG_DENY: dev_whitelist_rm(devcgroup, &wh); break; default: |
f92523e3a cgroup files: con... |
407 |
return -EINVAL; |
08ce5f16e cgroups: implemen... |
408 |
} |
f92523e3a cgroup files: con... |
409 410 |
return 0; } |
08ce5f16e cgroups: implemen... |
411 |
|
f92523e3a cgroup files: con... |
412 413 414 415 |
static int devcgroup_access_write(struct cgroup *cgrp, struct cftype *cft, const char *buffer) { int retval; |
b4046f00e devcgroup: avoid ... |
416 417 |
mutex_lock(&devcgroup_mutex); |
f92523e3a cgroup files: con... |
418 419 |
retval = devcgroup_update_access(cgroup_to_devcgroup(cgrp), cft->private, buffer); |
b4046f00e devcgroup: avoid ... |
420 |
mutex_unlock(&devcgroup_mutex); |
08ce5f16e cgroups: implemen... |
421 422 423 424 425 426 |
return retval; } static struct cftype dev_cgroup_files[] = { { .name = "allow", |
f92523e3a cgroup files: con... |
427 |
.write_string = devcgroup_access_write, |
08ce5f16e cgroups: implemen... |
428 429 430 431 |
.private = DEVCG_ALLOW, }, { .name = "deny", |
f92523e3a cgroup files: con... |
432 |
.write_string = devcgroup_access_write, |
08ce5f16e cgroups: implemen... |
433 434 |
.private = DEVCG_DENY, }, |
29486df32 cgroups: introduc... |
435 436 437 438 439 |
{ .name = "list", .read_seq_string = devcgroup_seq_read, .private = DEVCG_LIST, }, |
08ce5f16e cgroups: implemen... |
440 441 442 443 444 445 446 447 448 449 450 451 452 |
}; static int devcgroup_populate(struct cgroup_subsys *ss, struct cgroup *cgroup) { return cgroup_add_files(cgroup, ss, dev_cgroup_files, ARRAY_SIZE(dev_cgroup_files)); } struct cgroup_subsys devices_subsys = { .name = "devices", .can_attach = devcgroup_can_attach, .create = devcgroup_create, |
c5b60b5e6 security: whitesp... |
453 |
.destroy = devcgroup_destroy, |
08ce5f16e cgroups: implemen... |
454 455 456 |
.populate = devcgroup_populate, .subsys_id = devices_subsys_id, }; |
482e0cd3d devcgroup_inode_p... |
457 |
int __devcgroup_inode_permission(struct inode *inode, int mask) |
08ce5f16e cgroups: implemen... |
458 |
{ |
08ce5f16e cgroups: implemen... |
459 460 |
struct dev_cgroup *dev_cgroup; struct dev_whitelist_item *wh; |
4efd1a1b2 devcgroup: relax ... |
461 |
rcu_read_lock(); |
36fd71d29 devcgroup: fix ra... |
462 463 |
dev_cgroup = task_devcgroup(current); |
4efd1a1b2 devcgroup: relax ... |
464 |
list_for_each_entry_rcu(wh, &dev_cgroup->whitelist, list) { |
08ce5f16e cgroups: implemen... |
465 |
if (wh->type & DEV_ALL) |
cd5008196 devcgroup: skip s... |
466 |
goto found; |
08ce5f16e cgroups: implemen... |
467 468 469 470 471 472 473 474 |
if ((wh->type & DEV_BLOCK) && !S_ISBLK(inode->i_mode)) continue; if ((wh->type & DEV_CHAR) && !S_ISCHR(inode->i_mode)) continue; if (wh->major != ~0 && wh->major != imajor(inode)) continue; if (wh->minor != ~0 && wh->minor != iminor(inode)) continue; |
cd5008196 devcgroup: skip s... |
475 |
|
08ce5f16e cgroups: implemen... |
476 477 478 479 |
if ((mask & MAY_WRITE) && !(wh->access & ACC_WRITE)) continue; if ((mask & MAY_READ) && !(wh->access & ACC_READ)) continue; |
cd5008196 devcgroup: skip s... |
480 |
found: |
4efd1a1b2 devcgroup: relax ... |
481 |
rcu_read_unlock(); |
08ce5f16e cgroups: implemen... |
482 483 |
return 0; } |
36fd71d29 devcgroup: fix ra... |
484 |
|
4efd1a1b2 devcgroup: relax ... |
485 |
rcu_read_unlock(); |
08ce5f16e cgroups: implemen... |
486 487 488 489 490 491 |
return -EPERM; } int devcgroup_inode_mknod(int mode, dev_t dev) { |
08ce5f16e cgroups: implemen... |
492 493 |
struct dev_cgroup *dev_cgroup; struct dev_whitelist_item *wh; |
0b82ac37b devices cgroup: a... |
494 495 |
if (!S_ISBLK(mode) && !S_ISCHR(mode)) return 0; |
4efd1a1b2 devcgroup: relax ... |
496 |
rcu_read_lock(); |
36fd71d29 devcgroup: fix ra... |
497 498 |
dev_cgroup = task_devcgroup(current); |
116e05751 devcgroup: use li... |
499 |
list_for_each_entry_rcu(wh, &dev_cgroup->whitelist, list) { |
08ce5f16e cgroups: implemen... |
500 |
if (wh->type & DEV_ALL) |
cd5008196 devcgroup: skip s... |
501 |
goto found; |
08ce5f16e cgroups: implemen... |
502 503 504 505 506 507 508 509 |
if ((wh->type & DEV_BLOCK) && !S_ISBLK(mode)) continue; if ((wh->type & DEV_CHAR) && !S_ISCHR(mode)) continue; if (wh->major != ~0 && wh->major != MAJOR(dev)) continue; if (wh->minor != ~0 && wh->minor != MINOR(dev)) continue; |
cd5008196 devcgroup: skip s... |
510 |
|
08ce5f16e cgroups: implemen... |
511 512 |
if (!(wh->access & ACC_MKNOD)) continue; |
cd5008196 devcgroup: skip s... |
513 |
found: |
4efd1a1b2 devcgroup: relax ... |
514 |
rcu_read_unlock(); |
08ce5f16e cgroups: implemen... |
515 516 |
return 0; } |
36fd71d29 devcgroup: fix ra... |
517 |
|
4efd1a1b2 devcgroup: relax ... |
518 |
rcu_read_unlock(); |
36fd71d29 devcgroup: fix ra... |
519 |
|
08ce5f16e cgroups: implemen... |
520 521 |
return -EPERM; } |