security/device_cgroup.c - SHIFTPHONES/kernel/common - Gitiles

 /*
  * device_cgroup.c - device cgroup subsystem
  *
  * Copyright 2007 IBM Corp
  */

 #include <linux/device_cgroup.h>
 #include <linux/cgroup.h>
 #include <linux/ctype.h>
 #include <linux/list.h>
 #include <linux/uaccess.h>
 #include <linux/seq_file.h>
 #include <linux/rcupdate.h>

 #define ACC_MKNOD 1
 #define ACC_READ  2
 #define ACC_WRITE 4
 #define ACC_MASK (ACC_MKNOD | ACC_READ | ACC_WRITE)

 #define DEV_BLOCK 1
 #define DEV_CHAR  2
 #define DEV_ALL   4  /* this represents all devices */

 /*
  * whitelist locking rules:
  * hold cgroup_lock() for update/read.
  * hold rcu_read_lock() for read.
  */

 struct dev_whitelist_item {
 	u32 major, minor;
 	short type;
 	short access;
 	struct list_head list;
 	struct rcu_head rcu;
 };

 struct dev_cgroup {
 	struct cgroup_subsys_state css;
 	struct list_head whitelist;
 };

 static inline struct dev_cgroup *css_to_devcgroup(struct cgroup_subsys_state *s)
 {
 	return container_of(s, struct dev_cgroup, css);
 }

 static inline struct dev_cgroup *cgroup_to_devcgroup(struct cgroup *cgroup)
 {
 	return css_to_devcgroup(cgroup_subsys_state(cgroup, devices_subsys_id));
 }

 static inline struct dev_cgroup *task_devcgroup(struct task_struct *task)
 {
 	return css_to_devcgroup(task_subsys_state(task, devices_subsys_id));
 }

 struct cgroup_subsys devices_subsys;

 static int devcgroup_can_attach(struct cgroup_subsys *ss,
 		struct cgroup *new_cgroup, struct task_struct *task)
 {
 	if (current != task && !capable(CAP_SYS_ADMIN))
 			return -EPERM;

 	return 0;
 }

 /*
  * called under cgroup_lock()
  */
 static int dev_whitelist_copy(struct list_head *dest, struct list_head *orig)
 {
 	struct dev_whitelist_item *wh, *tmp, *new;

 	list_for_each_entry(wh, orig, list) {
 		new = kmemdup(wh, sizeof(*wh), GFP_KERNEL);
 		if (!new)
 			goto free_and_exit;
 		list_add_tail(&new->list, dest);
 	}

 	return 0;

 free_and_exit:
 	list_for_each_entry_safe(wh, tmp, dest, list) {
 		list_del(&wh->list);
 		kfree(wh);
 	}
 	return -ENOMEM;
 }

 /* Stupid prototype - don't bother combining existing entries */
 /*
  * called under cgroup_lock()
  */
 static int dev_whitelist_add(struct dev_cgroup *dev_cgroup,
 			struct dev_whitelist_item *wh)
 {
 	struct dev_whitelist_item *whcopy, *walk;

 	whcopy = kmemdup(wh, sizeof(*wh), GFP_KERNEL);
 	if (!whcopy)
 		return -ENOMEM;

 	list_for_each_entry(walk, &dev_cgroup->whitelist, list) {
 		if (walk->type != wh->type)
 			continue;
 		if (walk->major != wh->major)
 			continue;
 		if (walk->minor != wh->minor)
 			continue;

 		walk->access |= wh->access;
 		kfree(whcopy);
 		whcopy = NULL;
 	}

 	if (whcopy != NULL)
 		list_add_tail_rcu(&whcopy->list, &dev_cgroup->whitelist);
 	return 0;
 }

 static void whitelist_item_free(struct rcu_head *rcu)
 {
 	struct dev_whitelist_item *item;

 	item = container_of(rcu, struct dev_whitelist_item, rcu);
 	kfree(item);
 }

 /*
  * called under cgroup_lock()
  */
 static void dev_whitelist_rm(struct dev_cgroup *dev_cgroup,
 			struct dev_whitelist_item *wh)
 {
 	struct dev_whitelist_item *walk, *tmp;

 	list_for_each_entry_safe(walk, tmp, &dev_cgroup->whitelist, list) {
 		if (walk->type == DEV_ALL)
 			goto remove;
 		if (walk->type != wh->type)
 			continue;
 		if (walk->major != ~0 && walk->major != wh->major)
 			continue;
 		if (walk->minor != ~0 && walk->minor != wh->minor)
 			continue;

 remove:
 		walk->access &= ~wh->access;
 		if (!walk->access) {
 			list_del_rcu(&walk->list);
 			call_rcu(&walk->rcu, whitelist_item_free);
 		}
 	}
 }

 /*
  * called from kernel/cgroup.c with cgroup_lock() held.
  */
 static struct cgroup_subsys_state *devcgroup_create(struct cgroup_subsys *ss,
 						struct cgroup *cgroup)
 {
 	struct dev_cgroup *dev_cgroup, *parent_dev_cgroup;
 	struct cgroup *parent_cgroup;
 	int ret;

 	dev_cgroup = kzalloc(sizeof(*dev_cgroup), GFP_KERNEL);
 	if (!dev_cgroup)
 		return ERR_PTR(-ENOMEM);
 	INIT_LIST_HEAD(&dev_cgroup->whitelist);
 	parent_cgroup = cgroup->parent;

 	if (parent_cgroup == NULL) {
 		struct dev_whitelist_item *wh;
 		wh = kmalloc(sizeof(*wh), GFP_KERNEL);
 		if (!wh) {
 			kfree(dev_cgroup);
 			return ERR_PTR(-ENOMEM);
 		}
 		wh->minor = wh->major = ~0;
 		wh->type = DEV_ALL;
 		wh->access = ACC_MASK;
 		list_add(&wh->list, &dev_cgroup->whitelist);
 	} else {
 		parent_dev_cgroup = cgroup_to_devcgroup(parent_cgroup);
 		ret = dev_whitelist_copy(&dev_cgroup->whitelist,
 				&parent_dev_cgroup->whitelist);
 		if (ret) {
 			kfree(dev_cgroup);
 			return ERR_PTR(ret);
 		}
 	}

 	return &dev_cgroup->css;
 }

 static void devcgroup_destroy(struct cgroup_subsys *ss,
 			struct cgroup *cgroup)
 {
 	struct dev_cgroup *dev_cgroup;
 	struct dev_whitelist_item *wh, *tmp;

 	dev_cgroup = cgroup_to_devcgroup(cgroup);
 	list_for_each_entry_safe(wh, tmp, &dev_cgroup->whitelist, list) {
 		list_del(&wh->list);
 		kfree(wh);
 	}
 	kfree(dev_cgroup);
 }

 #define DEVCG_ALLOW 1
 #define DEVCG_DENY 2
 #define DEVCG_LIST 3

 #define MAJMINLEN 13
 #define ACCLEN 4

 static void set_access(char *acc, short access)
 {
 	int idx = 0;
 	memset(acc, 0, ACCLEN);
 	if (access & ACC_READ)
 		acc[idx++] = 'r';
 	if (access & ACC_WRITE)
 		acc[idx++] = 'w';
 	if (access & ACC_MKNOD)
 		acc[idx++] = 'm';
 }

 static char type_to_char(short type)
 {
 	if (type == DEV_ALL)
 		return 'a';
 	if (type == DEV_CHAR)
 		return 'c';
 	if (type == DEV_BLOCK)
 		return 'b';
 	return 'X';
 }

 static void set_majmin(char *str, unsigned m)
 {
 	if (m == ~0)
 		strcpy(str, "*");
 	else
 		sprintf(str, "%u", m);
 }

 static int devcgroup_seq_read(struct cgroup *cgroup, struct cftype *cft,
 				struct seq_file *m)
 {
 	struct dev_cgroup *devcgroup = cgroup_to_devcgroup(cgroup);
 	struct dev_whitelist_item *wh;
 	char maj[MAJMINLEN], min[MAJMINLEN], acc[ACCLEN];

 	rcu_read_lock();
 	list_for_each_entry_rcu(wh, &devcgroup->whitelist, list) {
 		set_access(acc, wh->access);
 		set_majmin(maj, wh->major);
 		set_majmin(min, wh->minor);
 		seq_printf(m, "%c %s:%s %s\n", type_to_char(wh->type),
 			   maj, min, acc);
 	}
 	rcu_read_unlock();

 	return 0;
 }

 /*
  * may_access_whitelist:
  * does the access granted to dev_cgroup c contain the access
  * requested in whitelist item refwh.
  * return 1 if yes, 0 if no.
  * call with c->lock held
  */
 static int may_access_whitelist(struct dev_cgroup *c,
 				       struct dev_whitelist_item *refwh)
 {
 	struct dev_whitelist_item *whitem;

 	list_for_each_entry(whitem, &c->whitelist, list) {
 		if (whitem->type & DEV_ALL)
 			return 1;
 		if ((refwh->type & DEV_BLOCK) && !(whitem->type & DEV_BLOCK))
 			continue;
 		if ((refwh->type & DEV_CHAR) && !(whitem->type & DEV_CHAR))
 			continue;
 		if (whitem->major != ~0 && whitem->major != refwh->major)
 			continue;
 		if (whitem->minor != ~0 && whitem->minor != refwh->minor)
 			continue;
 		if (refwh->access & (~whitem->access))
 			continue;
 		return 1;
 	}
 	return 0;
 }

 /*
  * parent_has_perm:
  * when adding a new allow rule to a device whitelist, the rule
  * must be allowed in the parent device
  */
 static int parent_has_perm(struct dev_cgroup *childcg,
 				  struct dev_whitelist_item *wh)
 {
 	struct cgroup *pcg = childcg->css.cgroup->parent;
 	struct dev_cgroup *parent;

 	if (!pcg)
 		return 1;
 	parent = cgroup_to_devcgroup(pcg);
 	return may_access_whitelist(parent, wh);
 }

 /*
  * Modify the whitelist using allow/deny rules.
  * CAP_SYS_ADMIN is needed for this.  It's at least separate from CAP_MKNOD
  * so we can give a container CAP_MKNOD to let it create devices but not
  * modify the whitelist.
  * It seems likely we'll want to add a CAP_CONTAINER capability to allow
  * us to also grant CAP_SYS_ADMIN to containers without giving away the
  * device whitelist controls, but for now we'll stick with CAP_SYS_ADMIN
  *
  * Taking rules away is always allowed (given CAP_SYS_ADMIN).  Granting
  * new access is only allowed if you're in the top-level cgroup, or your
  * parent cgroup has the access you're asking for.
  */
 static int devcgroup_update_access(struct dev_cgroup *devcgroup,
 				   int filetype, const char *buffer)
 {
 	const char *b;
 	char *endp;
 	int count;
 	struct dev_whitelist_item wh;

 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;

 	memset(&wh, 0, sizeof(wh));
 	b = buffer;

 	switch (*b) {
 	case 'a':
 		wh.type = DEV_ALL;
 		wh.access = ACC_MASK;
 		wh.major = ~0;
 		wh.minor = ~0;
 		goto handle;
 	case 'b':
 		wh.type = DEV_BLOCK;
 		break;
 	case 'c':
 		wh.type = DEV_CHAR;
 		break;
 	default:
 		return -EINVAL;
 	}
 	b++;
 	if (!isspace(*b))
 		return -EINVAL;
 	b++;
 	if (*b == '*') {
 		wh.major = ~0;
 		b++;
 	} else if (isdigit(*b)) {
 		wh.major = simple_strtoul(b, &endp, 10);
 		b = endp;
 	} else {
 		return -EINVAL;
 	}
 	if (*b != ':')
 		return -EINVAL;
 	b++;

 	/* read minor */
 	if (*b == '*') {
 		wh.minor = ~0;
 		b++;
 	} else if (isdigit(*b)) {
 		wh.minor = simple_strtoul(b, &endp, 10);
 		b = endp;
 	} else {
 		return -EINVAL;
 	}
 	if (!isspace(*b))
 		return -EINVAL;
 	for (b++, count = 0; count < 3; count++, b++) {
 		switch (*b) {
 		case 'r':
 			wh.access |= ACC_READ;
 			break;
 		case 'w':
 			wh.access |= ACC_WRITE;
 			break;
 		case 'm':
 			wh.access |= ACC_MKNOD;
 			break;
 		case '\n':
 		case '\0':
 			count = 3;
 			break;
 		default:
 			return -EINVAL;
 		}
 	}

 handle:
 	switch (filetype) {
 	case DEVCG_ALLOW:
 		if (!parent_has_perm(devcgroup, &wh))
 			return -EPERM;
 		return dev_whitelist_add(devcgroup, &wh);
 	case DEVCG_DENY:
 		dev_whitelist_rm(devcgroup, &wh);
 		break;
 	default:
 		return -EINVAL;
 	}
 	return 0;
 }

 static int devcgroup_access_write(struct cgroup *cgrp, struct cftype *cft,
 				  const char *buffer)
 {
 	int retval;
 	if (!cgroup_lock_live_group(cgrp))
 		return -ENODEV;
 	retval = devcgroup_update_access(cgroup_to_devcgroup(cgrp),
 					 cft->private, buffer);
 	cgroup_unlock();
 	return retval;
 }

 static struct cftype dev_cgroup_files[] = {
 	{
 		.name = "allow",
 		.write_string  = devcgroup_access_write,
 		.private = DEVCG_ALLOW,
 	},
 	{
 		.name = "deny",
 		.write_string = devcgroup_access_write,
 		.private = DEVCG_DENY,
 	},
 	{
 		.name = "list",
 		.read_seq_string = devcgroup_seq_read,
 		.private = DEVCG_LIST,
 	},
 };

 static int devcgroup_populate(struct cgroup_subsys *ss,
 				struct cgroup *cgroup)
 {
 	return cgroup_add_files(cgroup, ss, dev_cgroup_files,
 					ARRAY_SIZE(dev_cgroup_files));
 }

 struct cgroup_subsys devices_subsys = {
 	.name = "devices",
 	.can_attach = devcgroup_can_attach,
 	.create = devcgroup_create,
 	.destroy  = devcgroup_destroy,
 	.populate = devcgroup_populate,
 	.subsys_id = devices_subsys_id,
 };

 int devcgroup_inode_permission(struct inode *inode, int mask)
 {
 	struct dev_cgroup *dev_cgroup;
 	struct dev_whitelist_item *wh;

 	dev_t device = inode->i_rdev;
 	if (!device)
 		return 0;
 	if (!S_ISBLK(inode->i_mode) && !S_ISCHR(inode->i_mode))
 		return 0;

 	rcu_read_lock();

 	dev_cgroup = task_devcgroup(current);

 	list_for_each_entry_rcu(wh, &dev_cgroup->whitelist, list) {
 		if (wh->type & DEV_ALL)
 			goto acc_check;
 		if ((wh->type & DEV_BLOCK) && !S_ISBLK(inode->i_mode))
 			continue;
 		if ((wh->type & DEV_CHAR) && !S_ISCHR(inode->i_mode))
 			continue;
 		if (wh->major != ~0 && wh->major != imajor(inode))
 			continue;
 		if (wh->minor != ~0 && wh->minor != iminor(inode))
 			continue;
 acc_check:
 		if ((mask & MAY_WRITE) && !(wh->access & ACC_WRITE))
 			continue;
 		if ((mask & MAY_READ) && !(wh->access & ACC_READ))
 			continue;
 		rcu_read_unlock();
 		return 0;
 	}

 	rcu_read_unlock();

 	return -EPERM;
 }

 int devcgroup_inode_mknod(int mode, dev_t dev)
 {
 	struct dev_cgroup *dev_cgroup;
 	struct dev_whitelist_item *wh;

 	rcu_read_lock();

 	dev_cgroup = task_devcgroup(current);

 	list_for_each_entry_rcu(wh, &dev_cgroup->whitelist, list) {
 		if (wh->type & DEV_ALL)
 			goto acc_check;
 		if ((wh->type & DEV_BLOCK) && !S_ISBLK(mode))
 			continue;
 		if ((wh->type & DEV_CHAR) && !S_ISCHR(mode))
 			continue;
 		if (wh->major != ~0 && wh->major != MAJOR(dev))
 			continue;
 		if (wh->minor != ~0 && wh->minor != MINOR(dev))
 			continue;
 acc_check:
 		if (!(wh->access & ACC_MKNOD))
 			continue;
 		rcu_read_unlock();
 		return 0;
 	}

 	rcu_read_unlock();

 	return -EPERM;
 }
	/*
	* device_cgroup.c - device cgroup subsystem
	*
	* Copyright 2007 IBM Corp
	*/

	#include <linux/device_cgroup.h>
	#include <linux/cgroup.h>
	#include <linux/ctype.h>
	#include <linux/list.h>
	#include <linux/uaccess.h>
	#include <linux/seq_file.h>
	#include <linux/rcupdate.h>

	#define ACC_MKNOD 1
	#define ACC_READ 2
	#define ACC_WRITE 4
	#define ACC_MASK (ACC_MKNOD \| ACC_READ \| ACC_WRITE)

	#define DEV_BLOCK 1
	#define DEV_CHAR 2
	#define DEV_ALL 4 /* this represents all devices */

	/*
	* whitelist locking rules:
	* hold cgroup_lock() for update/read.
	* hold rcu_read_lock() for read.
	*/

	struct dev_whitelist_item {
	u32 major, minor;
	short type;
	short access;
	struct list_head list;
	struct rcu_head rcu;
	};

	struct dev_cgroup {
	struct cgroup_subsys_state css;
	struct list_head whitelist;
	};

	static inline struct dev_cgroup css_to_devcgroup(struct cgroup_subsys_state s)
	{
	return container_of(s, struct dev_cgroup, css);
	}

	static inline struct dev_cgroup cgroup_to_devcgroup(struct cgroup cgroup)
	{
	return css_to_devcgroup(cgroup_subsys_state(cgroup, devices_subsys_id));
	}

	static inline struct dev_cgroup task_devcgroup(struct task_struct task)
	{
	return css_to_devcgroup(task_subsys_state(task, devices_subsys_id));
	}

	struct cgroup_subsys devices_subsys;

	static int devcgroup_can_attach(struct cgroup_subsys *ss,
	struct cgroup new_cgroup, struct task_struct task)
	{
	if (current != task && !capable(CAP_SYS_ADMIN))
	return -EPERM;

	return 0;
	}

	/*
	* called under cgroup_lock()
	*/
	static int dev_whitelist_copy(struct list_head dest, struct list_head orig)
	{
	struct dev_whitelist_item wh, tmp, *new;

	list_for_each_entry(wh, orig, list) {
	new = kmemdup(wh, sizeof(*wh), GFP_KERNEL);
	if (!new)
	goto free_and_exit;
	list_add_tail(&new->list, dest);
	}

	return 0;

	free_and_exit:
	list_for_each_entry_safe(wh, tmp, dest, list) {
	list_del(&wh->list);
	kfree(wh);
	}
	return -ENOMEM;
	}

	/* Stupid prototype - don't bother combining existing entries */
	/*
	* called under cgroup_lock()
	*/
	static int dev_whitelist_add(struct dev_cgroup *dev_cgroup,
	struct dev_whitelist_item *wh)
	{
	struct dev_whitelist_item whcopy, walk;

	whcopy = kmemdup(wh, sizeof(*wh), GFP_KERNEL);
	if (!whcopy)
	return -ENOMEM;

	list_for_each_entry(walk, &dev_cgroup->whitelist, list) {
	if (walk->type != wh->type)
	continue;
	if (walk->major != wh->major)
	continue;
	if (walk->minor != wh->minor)
	continue;

	walk->access \|= wh->access;
	kfree(whcopy);
	whcopy = NULL;
	}

	if (whcopy != NULL)
	list_add_tail_rcu(&whcopy->list, &dev_cgroup->whitelist);
	return 0;
	}

	static void whitelist_item_free(struct rcu_head *rcu)
	{
	struct dev_whitelist_item *item;

	item = container_of(rcu, struct dev_whitelist_item, rcu);
	kfree(item);
	}

	/*
	* called under cgroup_lock()
	*/
	static void dev_whitelist_rm(struct dev_cgroup *dev_cgroup,
	struct dev_whitelist_item *wh)
	{
	struct dev_whitelist_item walk, tmp;

	list_for_each_entry_safe(walk, tmp, &dev_cgroup->whitelist, list) {
	if (walk->type == DEV_ALL)
	goto remove;
	if (walk->type != wh->type)
	continue;
	if (walk->major != ~0 && walk->major != wh->major)
	continue;
	if (walk->minor != ~0 && walk->minor != wh->minor)
	continue;

	remove:
	walk->access &= ~wh->access;
	if (!walk->access) {
	list_del_rcu(&walk->list);
	call_rcu(&walk->rcu, whitelist_item_free);
	}
	}
	}

	/*
	* called from kernel/cgroup.c with cgroup_lock() held.
	*/
	static struct cgroup_subsys_state devcgroup_create(struct cgroup_subsys ss,
	struct cgroup *cgroup)
	{
	struct dev_cgroup dev_cgroup, parent_dev_cgroup;
	struct cgroup *parent_cgroup;
	int ret;

	dev_cgroup = kzalloc(sizeof(*dev_cgroup), GFP_KERNEL);
	if (!dev_cgroup)
	return ERR_PTR(-ENOMEM);
	INIT_LIST_HEAD(&dev_cgroup->whitelist);
	parent_cgroup = cgroup->parent;

	if (parent_cgroup == NULL) {
	struct dev_whitelist_item *wh;
	wh = kmalloc(sizeof(*wh), GFP_KERNEL);
	if (!wh) {
	kfree(dev_cgroup);
	return ERR_PTR(-ENOMEM);
	}
	wh->minor = wh->major = ~0;
	wh->type = DEV_ALL;
	wh->access = ACC_MASK;
	list_add(&wh->list, &dev_cgroup->whitelist);
	} else {
	parent_dev_cgroup = cgroup_to_devcgroup(parent_cgroup);
	ret = dev_whitelist_copy(&dev_cgroup->whitelist,
	&parent_dev_cgroup->whitelist);
	if (ret) {
	kfree(dev_cgroup);
	return ERR_PTR(ret);
	}
	}

	return &dev_cgroup->css;
	}

	static void devcgroup_destroy(struct cgroup_subsys *ss,
	struct cgroup *cgroup)
	{
	struct dev_cgroup *dev_cgroup;
	struct dev_whitelist_item wh, tmp;

	dev_cgroup = cgroup_to_devcgroup(cgroup);
	list_for_each_entry_safe(wh, tmp, &dev_cgroup->whitelist, list) {
	list_del(&wh->list);
	kfree(wh);
	}
	kfree(dev_cgroup);
	}

	#define DEVCG_ALLOW 1
	#define DEVCG_DENY 2
	#define DEVCG_LIST 3

	#define MAJMINLEN 13
	#define ACCLEN 4

	static void set_access(char *acc, short access)
	{
	int idx = 0;
	memset(acc, 0, ACCLEN);
	if (access & ACC_READ)
	acc[idx++] = 'r';
	if (access & ACC_WRITE)
	acc[idx++] = 'w';
	if (access & ACC_MKNOD)
	acc[idx++] = 'm';
	}

	static char type_to_char(short type)
	{
	if (type == DEV_ALL)
	return 'a';
	if (type == DEV_CHAR)
	return 'c';
	if (type == DEV_BLOCK)
	return 'b';
	return 'X';
	}

	static void set_majmin(char *str, unsigned m)
	{
	if (m == ~0)
	strcpy(str, "*");
	else
	sprintf(str, "%u", m);
	}

	static int devcgroup_seq_read(struct cgroup cgroup, struct cftype cft,
	struct seq_file *m)
	{
	struct dev_cgroup *devcgroup = cgroup_to_devcgroup(cgroup);
	struct dev_whitelist_item *wh;
	char maj[MAJMINLEN], min[MAJMINLEN], acc[ACCLEN];

	rcu_read_lock();
	list_for_each_entry_rcu(wh, &devcgroup->whitelist, list) {
	set_access(acc, wh->access);
	set_majmin(maj, wh->major);
	set_majmin(min, wh->minor);
	seq_printf(m, "%c %s:%s %s\n", type_to_char(wh->type),
	maj, min, acc);
	}
	rcu_read_unlock();

	return 0;
	}

	/*
	* may_access_whitelist:
	* does the access granted to dev_cgroup c contain the access
	* requested in whitelist item refwh.
	* return 1 if yes, 0 if no.
	* call with c->lock held
	*/
	static int may_access_whitelist(struct dev_cgroup *c,
	struct dev_whitelist_item *refwh)
	{
	struct dev_whitelist_item *whitem;

	list_for_each_entry(whitem, &c->whitelist, list) {
	if (whitem->type & DEV_ALL)
	return 1;
	if ((refwh->type & DEV_BLOCK) && !(whitem->type & DEV_BLOCK))
	continue;
	if ((refwh->type & DEV_CHAR) && !(whitem->type & DEV_CHAR))
	continue;
	if (whitem->major != ~0 && whitem->major != refwh->major)
	continue;
	if (whitem->minor != ~0 && whitem->minor != refwh->minor)
	continue;
	if (refwh->access & (~whitem->access))
	continue;
	return 1;
	}
	return 0;
	}

	/*
	* parent_has_perm:
	* when adding a new allow rule to a device whitelist, the rule
	* must be allowed in the parent device
	*/
	static int parent_has_perm(struct dev_cgroup *childcg,
	struct dev_whitelist_item *wh)
	{
	struct cgroup *pcg = childcg->css.cgroup->parent;
	struct dev_cgroup *parent;

	if (!pcg)
	return 1;
	parent = cgroup_to_devcgroup(pcg);
	return may_access_whitelist(parent, wh);
	}

	/*
	* Modify the whitelist using allow/deny rules.
	* CAP_SYS_ADMIN is needed for this. It's at least separate from CAP_MKNOD
	* so we can give a container CAP_MKNOD to let it create devices but not
	* modify the whitelist.
	* It seems likely we'll want to add a CAP_CONTAINER capability to allow
	* us to also grant CAP_SYS_ADMIN to containers without giving away the
	* device whitelist controls, but for now we'll stick with CAP_SYS_ADMIN
	*
	* Taking rules away is always allowed (given CAP_SYS_ADMIN). Granting
	* new access is only allowed if you're in the top-level cgroup, or your
	* parent cgroup has the access you're asking for.
	*/
	static int devcgroup_update_access(struct dev_cgroup *devcgroup,
	int filetype, const char *buffer)
	{
	const char *b;
	char *endp;
	int count;
	struct dev_whitelist_item wh;

	if (!capable(CAP_SYS_ADMIN))
	return -EPERM;

	memset(&wh, 0, sizeof(wh));
	b = buffer;

	switch (*b) {
	case 'a':
	wh.type = DEV_ALL;
	wh.access = ACC_MASK;
	wh.major = ~0;
	wh.minor = ~0;
	goto handle;
	case 'b':
	wh.type = DEV_BLOCK;
	break;
	case 'c':
	wh.type = DEV_CHAR;
	break;
	default:
	return -EINVAL;
	}
	b++;
	if (!isspace(*b))
	return -EINVAL;
	b++;
	if (b == '') {
	wh.major = ~0;
	b++;
	} else if (isdigit(*b)) {
	wh.major = simple_strtoul(b, &endp, 10);
	b = endp;
	} else {
	return -EINVAL;
	}
	if (*b != ':')
	return -EINVAL;
	b++;

	/* read minor */
	if (b == '') {
	wh.minor = ~0;
	b++;
	} else if (isdigit(*b)) {
	wh.minor = simple_strtoul(b, &endp, 10);
	b = endp;
	} else {
	return -EINVAL;
	}
	if (!isspace(*b))
	return -EINVAL;
	for (b++, count = 0; count < 3; count++, b++) {
	switch (*b) {
	case 'r':
	wh.access \|= ACC_READ;
	break;
	case 'w':
	wh.access \|= ACC_WRITE;
	break;
	case 'm':
	wh.access \|= ACC_MKNOD;
	break;
	case '\n':
	case '\0':
	count = 3;
	break;
	default:
	return -EINVAL;
	}
	}

	handle:
	switch (filetype) {
	case DEVCG_ALLOW:
	if (!parent_has_perm(devcgroup, &wh))
	return -EPERM;
	return dev_whitelist_add(devcgroup, &wh);
	case DEVCG_DENY:
	dev_whitelist_rm(devcgroup, &wh);
	break;
	default:
	return -EINVAL;
	}
	return 0;
	}

	static int devcgroup_access_write(struct cgroup cgrp, struct cftype cft,
	const char *buffer)
	{
	int retval;
	if (!cgroup_lock_live_group(cgrp))
	return -ENODEV;
	retval = devcgroup_update_access(cgroup_to_devcgroup(cgrp),
	cft->private, buffer);
	cgroup_unlock();
	return retval;
	}

	static struct cftype dev_cgroup_files[] = {
	{
	.name = "allow",
	.write_string = devcgroup_access_write,
	.private = DEVCG_ALLOW,
	},
	{
	.name = "deny",
	.write_string = devcgroup_access_write,
	.private = DEVCG_DENY,
	},
	{
	.name = "list",
	.read_seq_string = devcgroup_seq_read,
	.private = DEVCG_LIST,
	},
	};

	static int devcgroup_populate(struct cgroup_subsys *ss,
	struct cgroup *cgroup)
	{
	return cgroup_add_files(cgroup, ss, dev_cgroup_files,
	ARRAY_SIZE(dev_cgroup_files));
	}

	struct cgroup_subsys devices_subsys = {
	.name = "devices",
	.can_attach = devcgroup_can_attach,
	.create = devcgroup_create,
	.destroy = devcgroup_destroy,
	.populate = devcgroup_populate,
	.subsys_id = devices_subsys_id,
	};

	int devcgroup_inode_permission(struct inode *inode, int mask)
	{
	struct dev_cgroup *dev_cgroup;
	struct dev_whitelist_item *wh;

	dev_t device = inode->i_rdev;
	if (!device)
	return 0;
	if (!S_ISBLK(inode->i_mode) && !S_ISCHR(inode->i_mode))
	return 0;

	rcu_read_lock();

	dev_cgroup = task_devcgroup(current);

	list_for_each_entry_rcu(wh, &dev_cgroup->whitelist, list) {
	if (wh->type & DEV_ALL)
	goto acc_check;
	if ((wh->type & DEV_BLOCK) && !S_ISBLK(inode->i_mode))
	continue;
	if ((wh->type & DEV_CHAR) && !S_ISCHR(inode->i_mode))
	continue;
	if (wh->major != ~0 && wh->major != imajor(inode))
	continue;
	if (wh->minor != ~0 && wh->minor != iminor(inode))
	continue;
	acc_check:
	if ((mask & MAY_WRITE) && !(wh->access & ACC_WRITE))
	continue;
	if ((mask & MAY_READ) && !(wh->access & ACC_READ))
	continue;
	rcu_read_unlock();
	return 0;
	}

	rcu_read_unlock();

	return -EPERM;
	}

	int devcgroup_inode_mknod(int mode, dev_t dev)
	{
	struct dev_cgroup *dev_cgroup;
	struct dev_whitelist_item *wh;

	rcu_read_lock();

	dev_cgroup = task_devcgroup(current);

	list_for_each_entry_rcu(wh, &dev_cgroup->whitelist, list) {
	if (wh->type & DEV_ALL)
	goto acc_check;
	if ((wh->type & DEV_BLOCK) && !S_ISBLK(mode))
	continue;
	if ((wh->type & DEV_CHAR) && !S_ISCHR(mode))
	continue;
	if (wh->major != ~0 && wh->major != MAJOR(dev))
	continue;
	if (wh->minor != ~0 && wh->minor != MINOR(dev))
	continue;
	acc_check:
	if (!(wh->access & ACC_MKNOD))
	continue;
	rcu_read_unlock();
	return 0;
	}

	rcu_read_unlock();

	return -EPERM;
	}