linux-kernel - Re: [PATCH] device_cgroup: Roll back to original exceptions after copy failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHC9VhRa16htUXSN0AXrbUwadRa-qQv+UX8ZO_8W_z2eL=6trw@mail.gmail.com>
Date:   Wed, 16 Nov 2022 18:33:53 -0500
From:   Paul Moore <paul@...l-moore.com>
To:     Wang Weiyang <wangweiyang2@...wei.com>
Cc:     jmorris@...ei.org, serge@...lyn.com, serge.hallyn@...onical.com,
        akpm@...ux-foundation.org, aris@...hat.com,
        linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] device_cgroup: Roll back to original exceptions after
 copy failure

On Tue, Oct 25, 2022 at 7:02 AM Wang Weiyang <wangweiyang2@...wei.com> wrote:
>
> When add the 'a *:* rwm' entry to devcgroup A's whitelist, at first A's
> exceptions will be cleaned and A's behavior is changed to
> DEVCG_DEFAULT_ALLOW. Then parent's exceptions will be copyed to A's
> whitelist. If copy failure occurs, just return leaving A to grant
> permissions to all devices. And A may grant more permissions than
> parent.
>
> Backup A's whitelist and recover original exceptions after copy
> failure.
>
> Fixes: 4cef7299b478 ("device_cgroup: add proper checking when changing default behavior")
> Signed-off-by: Wang Weiyang <wangweiyang2@...wei.com>
> ---
>  security/device_cgroup.c | 33 +++++++++++++++++++++++++++++----
>  1 file changed, 29 insertions(+), 4 deletions(-)

Merged into lsm/next, but with a stable@...r tag.  Normally I would
merge something like this into lsm/stable-X.Y and send it up to Linus
after a few days, but I'd really like this to spend some time in
linux-next before going up to Linus.

-- 
paul-moore.com