Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux...
[linux-2.6] / security / device_cgroup.c
1 /*
2  * dev_cgroup.c - device cgroup subsystem
3  *
4  * Copyright 2007 IBM Corp
5  */
6
7 #include <linux/device_cgroup.h>
8 #include <linux/cgroup.h>
9 #include <linux/ctype.h>
10 #include <linux/list.h>
11 #include <linux/uaccess.h>
12 #include <linux/seq_file.h>
13
14 #define ACC_MKNOD 1
15 #define ACC_READ  2
16 #define ACC_WRITE 4
17 #define ACC_MASK (ACC_MKNOD | ACC_READ | ACC_WRITE)
18
19 #define DEV_BLOCK 1
20 #define DEV_CHAR  2
21 #define DEV_ALL   4  /* this represents all devices */
22
23 /*
24  * whitelist locking rules:
25  * cgroup_lock() cannot be taken under dev_cgroup->lock.
26  * dev_cgroup->lock can be taken with or without cgroup_lock().
27  *
28  * modifications always require cgroup_lock
29  * modifications to a list which is visible require the
30  *   dev_cgroup->lock *and* cgroup_lock()
31  * walking the list requires dev_cgroup->lock or cgroup_lock().
32  *
33  * reasoning: dev_whitelist_copy() needs to kmalloc, so needs
34  *   a mutex, which the cgroup_lock() is.  Since modifying
35  *   a visible list requires both locks, either lock can be
36  *   taken for walking the list.
37  */
38
39 struct dev_whitelist_item {
40         u32 major, minor;
41         short type;
42         short access;
43         struct list_head list;
44 };
45
46 struct dev_cgroup {
47         struct cgroup_subsys_state css;
48         struct list_head whitelist;
49         spinlock_t lock;
50 };
51
52 static inline struct dev_cgroup *cgroup_to_devcgroup(struct cgroup *cgroup)
53 {
54         return container_of(cgroup_subsys_state(cgroup, devices_subsys_id),
55                             struct dev_cgroup, css);
56 }
57
58 struct cgroup_subsys devices_subsys;
59
60 static int devcgroup_can_attach(struct cgroup_subsys *ss,
61                 struct cgroup *new_cgroup, struct task_struct *task)
62 {
63         if (current != task && !capable(CAP_SYS_ADMIN))
64                         return -EPERM;
65
66         return 0;
67 }
68
69 /*
70  * called under cgroup_lock()
71  */
72 static int dev_whitelist_copy(struct list_head *dest, struct list_head *orig)
73 {
74         struct dev_whitelist_item *wh, *tmp, *new;
75
76         list_for_each_entry(wh, orig, list) {
77                 new = kmalloc(sizeof(*wh), GFP_KERNEL);
78                 if (!new)
79                         goto free_and_exit;
80                 new->major = wh->major;
81                 new->minor = wh->minor;
82                 new->type = wh->type;
83                 new->access = wh->access;
84                 list_add_tail(&new->list, dest);
85         }
86
87         return 0;
88
89 free_and_exit:
90         list_for_each_entry_safe(wh, tmp, dest, list) {
91                 list_del(&wh->list);
92                 kfree(wh);
93         }
94         return -ENOMEM;
95 }
96
97 /* Stupid prototype - don't bother combining existing entries */
98 /*
99  * called under cgroup_lock()
100  * since the list is visible to other tasks, we need the spinlock also
101  */
102 static int dev_whitelist_add(struct dev_cgroup *dev_cgroup,
103                         struct dev_whitelist_item *wh)
104 {
105         struct dev_whitelist_item *whcopy;
106
107         whcopy = kmalloc(sizeof(*whcopy), GFP_KERNEL);
108         if (!whcopy)
109                 return -ENOMEM;
110
111         memcpy(whcopy, wh, sizeof(*whcopy));
112         spin_lock(&dev_cgroup->lock);
113         list_add_tail(&whcopy->list, &dev_cgroup->whitelist);
114         spin_unlock(&dev_cgroup->lock);
115         return 0;
116 }
117
118 /*
119  * called under cgroup_lock()
120  * since the list is visible to other tasks, we need the spinlock also
121  */
122 static void dev_whitelist_rm(struct dev_cgroup *dev_cgroup,
123                         struct dev_whitelist_item *wh)
124 {
125         struct dev_whitelist_item *walk, *tmp;
126
127         spin_lock(&dev_cgroup->lock);
128         list_for_each_entry_safe(walk, tmp, &dev_cgroup->whitelist, list) {
129                 if (walk->type == DEV_ALL)
130                         goto remove;
131                 if (walk->type != wh->type)
132                         continue;
133                 if (walk->major != ~0 && walk->major != wh->major)
134                         continue;
135                 if (walk->minor != ~0 && walk->minor != wh->minor)
136                         continue;
137
138 remove:
139                 walk->access &= ~wh->access;
140                 if (!walk->access) {
141                         list_del(&walk->list);
142                         kfree(walk);
143                 }
144         }
145         spin_unlock(&dev_cgroup->lock);
146 }
147
148 /*
149  * called from kernel/cgroup.c with cgroup_lock() held.
150  */
151 static struct cgroup_subsys_state *devcgroup_create(struct cgroup_subsys *ss,
152                                                 struct cgroup *cgroup)
153 {
154         struct dev_cgroup *dev_cgroup, *parent_dev_cgroup;
155         struct cgroup *parent_cgroup;
156         int ret;
157
158         dev_cgroup = kzalloc(sizeof(*dev_cgroup), GFP_KERNEL);
159         if (!dev_cgroup)
160                 return ERR_PTR(-ENOMEM);
161         INIT_LIST_HEAD(&dev_cgroup->whitelist);
162         parent_cgroup = cgroup->parent;
163
164         if (parent_cgroup == NULL) {
165                 struct dev_whitelist_item *wh;
166                 wh = kmalloc(sizeof(*wh), GFP_KERNEL);
167                 if (!wh) {
168                         kfree(dev_cgroup);
169                         return ERR_PTR(-ENOMEM);
170                 }
171                 wh->minor = wh->major = ~0;
172                 wh->type = DEV_ALL;
173                 wh->access = ACC_MKNOD | ACC_READ | ACC_WRITE;
174                 list_add(&wh->list, &dev_cgroup->whitelist);
175         } else {
176                 parent_dev_cgroup = cgroup_to_devcgroup(parent_cgroup);
177                 ret = dev_whitelist_copy(&dev_cgroup->whitelist,
178                                 &parent_dev_cgroup->whitelist);
179                 if (ret) {
180                         kfree(dev_cgroup);
181                         return ERR_PTR(ret);
182                 }
183         }
184
185         spin_lock_init(&dev_cgroup->lock);
186         return &dev_cgroup->css;
187 }
188
189 static void devcgroup_destroy(struct cgroup_subsys *ss,
190                         struct cgroup *cgroup)
191 {
192         struct dev_cgroup *dev_cgroup;
193         struct dev_whitelist_item *wh, *tmp;
194
195         dev_cgroup = cgroup_to_devcgroup(cgroup);
196         list_for_each_entry_safe(wh, tmp, &dev_cgroup->whitelist, list) {
197                 list_del(&wh->list);
198                 kfree(wh);
199         }
200         kfree(dev_cgroup);
201 }
202
203 #define DEVCG_ALLOW 1
204 #define DEVCG_DENY 2
205 #define DEVCG_LIST 3
206
207 #define MAJMINLEN 10
208 #define ACCLEN 4
209
210 static void set_access(char *acc, short access)
211 {
212         int idx = 0;
213         memset(acc, 0, ACCLEN);
214         if (access & ACC_READ)
215                 acc[idx++] = 'r';
216         if (access & ACC_WRITE)
217                 acc[idx++] = 'w';
218         if (access & ACC_MKNOD)
219                 acc[idx++] = 'm';
220 }
221
222 static char type_to_char(short type)
223 {
224         if (type == DEV_ALL)
225                 return 'a';
226         if (type == DEV_CHAR)
227                 return 'c';
228         if (type == DEV_BLOCK)
229                 return 'b';
230         return 'X';
231 }
232
233 static void set_majmin(char *str, unsigned m)
234 {
235         memset(str, 0, MAJMINLEN);
236         if (m == ~0)
237                 sprintf(str, "*");
238         else
239                 snprintf(str, MAJMINLEN, "%d", m);
240 }
241
242 static int devcgroup_seq_read(struct cgroup *cgroup, struct cftype *cft,
243                                 struct seq_file *m)
244 {
245         struct dev_cgroup *devcgroup = cgroup_to_devcgroup(cgroup);
246         struct dev_whitelist_item *wh;
247         char maj[MAJMINLEN], min[MAJMINLEN], acc[ACCLEN];
248
249         spin_lock(&devcgroup->lock);
250         list_for_each_entry(wh, &devcgroup->whitelist, list) {
251                 set_access(acc, wh->access);
252                 set_majmin(maj, wh->major);
253                 set_majmin(min, wh->minor);
254                 seq_printf(m, "%c %s:%s %s\n", type_to_char(wh->type),
255                            maj, min, acc);
256         }
257         spin_unlock(&devcgroup->lock);
258
259         return 0;
260 }
261
262 /*
263  * may_access_whitelist:
264  * does the access granted to dev_cgroup c contain the access
265  * requested in whitelist item refwh.
266  * return 1 if yes, 0 if no.
267  * call with c->lock held
268  */
269 static int may_access_whitelist(struct dev_cgroup *c,
270                                        struct dev_whitelist_item *refwh)
271 {
272         struct dev_whitelist_item *whitem;
273
274         list_for_each_entry(whitem, &c->whitelist, list) {
275                 if (whitem->type & DEV_ALL)
276                         return 1;
277                 if ((refwh->type & DEV_BLOCK) && !(whitem->type & DEV_BLOCK))
278                         continue;
279                 if ((refwh->type & DEV_CHAR) && !(whitem->type & DEV_CHAR))
280                         continue;
281                 if (whitem->major != ~0 && whitem->major != refwh->major)
282                         continue;
283                 if (whitem->minor != ~0 && whitem->minor != refwh->minor)
284                         continue;
285                 if (refwh->access & (~(whitem->access | ACC_MASK)))
286                         continue;
287                 return 1;
288         }
289         return 0;
290 }
291
292 /*
293  * parent_has_perm:
294  * when adding a new allow rule to a device whitelist, the rule
295  * must be allowed in the parent device
296  */
297 static int parent_has_perm(struct cgroup *childcg,
298                                   struct dev_whitelist_item *wh)
299 {
300         struct cgroup *pcg = childcg->parent;
301         struct dev_cgroup *parent;
302         int ret;
303
304         if (!pcg)
305                 return 1;
306         parent = cgroup_to_devcgroup(pcg);
307         spin_lock(&parent->lock);
308         ret = may_access_whitelist(parent, wh);
309         spin_unlock(&parent->lock);
310         return ret;
311 }
312
313 /*
314  * Modify the whitelist using allow/deny rules.
315  * CAP_SYS_ADMIN is needed for this.  It's at least separate from CAP_MKNOD
316  * so we can give a container CAP_MKNOD to let it create devices but not
317  * modify the whitelist.
318  * It seems likely we'll want to add a CAP_CONTAINER capability to allow
319  * us to also grant CAP_SYS_ADMIN to containers without giving away the
320  * device whitelist controls, but for now we'll stick with CAP_SYS_ADMIN
321  *
322  * Taking rules away is always allowed (given CAP_SYS_ADMIN).  Granting
323  * new access is only allowed if you're in the top-level cgroup, or your
324  * parent cgroup has the access you're asking for.
325  */
326 static ssize_t devcgroup_access_write(struct cgroup *cgroup, struct cftype *cft,
327                                 struct file *file, const char __user *userbuf,
328                                 size_t nbytes, loff_t *ppos)
329 {
330         struct cgroup *cur_cgroup;
331         struct dev_cgroup *devcgroup, *cur_devcgroup;
332         int filetype = cft->private;
333         char *buffer, *b;
334         int retval = 0, count;
335         struct dev_whitelist_item wh;
336
337         if (!capable(CAP_SYS_ADMIN))
338                 return -EPERM;
339
340         devcgroup = cgroup_to_devcgroup(cgroup);
341         cur_cgroup = task_cgroup(current, devices_subsys.subsys_id);
342         cur_devcgroup = cgroup_to_devcgroup(cur_cgroup);
343
344         buffer = kmalloc(nbytes+1, GFP_KERNEL);
345         if (!buffer)
346                 return -ENOMEM;
347
348         if (copy_from_user(buffer, userbuf, nbytes)) {
349                 retval = -EFAULT;
350                 goto out1;
351         }
352         buffer[nbytes] = 0;     /* nul-terminate */
353
354         cgroup_lock();
355         if (cgroup_is_removed(cgroup)) {
356                 retval = -ENODEV;
357                 goto out2;
358         }
359
360         memset(&wh, 0, sizeof(wh));
361         b = buffer;
362
363         switch (*b) {
364         case 'a':
365                 wh.type = DEV_ALL;
366                 wh.access = ACC_MASK;
367                 goto handle;
368         case 'b':
369                 wh.type = DEV_BLOCK;
370                 break;
371         case 'c':
372                 wh.type = DEV_CHAR;
373                 break;
374         default:
375                 retval = -EINVAL;
376                 goto out2;
377         }
378         b++;
379         if (!isspace(*b)) {
380                 retval = -EINVAL;
381                 goto out2;
382         }
383         b++;
384         if (*b == '*') {
385                 wh.major = ~0;
386                 b++;
387         } else if (isdigit(*b)) {
388                 wh.major = 0;
389                 while (isdigit(*b)) {
390                         wh.major = wh.major*10+(*b-'0');
391                         b++;
392                 }
393         } else {
394                 retval = -EINVAL;
395                 goto out2;
396         }
397         if (*b != ':') {
398                 retval = -EINVAL;
399                 goto out2;
400         }
401         b++;
402
403         /* read minor */
404         if (*b == '*') {
405                 wh.minor = ~0;
406                 b++;
407         } else if (isdigit(*b)) {
408                 wh.minor = 0;
409                 while (isdigit(*b)) {
410                         wh.minor = wh.minor*10+(*b-'0');
411                         b++;
412                 }
413         } else {
414                 retval = -EINVAL;
415                 goto out2;
416         }
417         if (!isspace(*b)) {
418                 retval = -EINVAL;
419                 goto out2;
420         }
421         for (b++, count = 0; count < 3; count++, b++) {
422                 switch (*b) {
423                 case 'r':
424                         wh.access |= ACC_READ;
425                         break;
426                 case 'w':
427                         wh.access |= ACC_WRITE;
428                         break;
429                 case 'm':
430                         wh.access |= ACC_MKNOD;
431                         break;
432                 case '\n':
433                 case '\0':
434                         count = 3;
435                         break;
436                 default:
437                         retval = -EINVAL;
438                         goto out2;
439                 }
440         }
441
442 handle:
443         retval = 0;
444         switch (filetype) {
445         case DEVCG_ALLOW:
446                 if (!parent_has_perm(cgroup, &wh))
447                         retval = -EPERM;
448                 else
449                         retval = dev_whitelist_add(devcgroup, &wh);
450                 break;
451         case DEVCG_DENY:
452                 dev_whitelist_rm(devcgroup, &wh);
453                 break;
454         default:
455                 retval = -EINVAL;
456                 goto out2;
457         }
458
459         if (retval == 0)
460                 retval = nbytes;
461
462 out2:
463         cgroup_unlock();
464 out1:
465         kfree(buffer);
466         return retval;
467 }
468
469 static struct cftype dev_cgroup_files[] = {
470         {
471                 .name = "allow",
472                 .write  = devcgroup_access_write,
473                 .private = DEVCG_ALLOW,
474         },
475         {
476                 .name = "deny",
477                 .write = devcgroup_access_write,
478                 .private = DEVCG_DENY,
479         },
480         {
481                 .name = "list",
482                 .read_seq_string = devcgroup_seq_read,
483                 .private = DEVCG_LIST,
484         },
485 };
486
487 static int devcgroup_populate(struct cgroup_subsys *ss,
488                                 struct cgroup *cgroup)
489 {
490         return cgroup_add_files(cgroup, ss, dev_cgroup_files,
491                                         ARRAY_SIZE(dev_cgroup_files));
492 }
493
494 struct cgroup_subsys devices_subsys = {
495         .name = "devices",
496         .can_attach = devcgroup_can_attach,
497         .create = devcgroup_create,
498         .destroy  = devcgroup_destroy,
499         .populate = devcgroup_populate,
500         .subsys_id = devices_subsys_id,
501 };
502
503 int devcgroup_inode_permission(struct inode *inode, int mask)
504 {
505         struct cgroup *cgroup;
506         struct dev_cgroup *dev_cgroup;
507         struct dev_whitelist_item *wh;
508
509         dev_t device = inode->i_rdev;
510         if (!device)
511                 return 0;
512         if (!S_ISBLK(inode->i_mode) && !S_ISCHR(inode->i_mode))
513                 return 0;
514         cgroup = task_cgroup(current, devices_subsys.subsys_id);
515         dev_cgroup = cgroup_to_devcgroup(cgroup);
516         if (!dev_cgroup)
517                 return 0;
518
519         spin_lock(&dev_cgroup->lock);
520         list_for_each_entry(wh, &dev_cgroup->whitelist, list) {
521                 if (wh->type & DEV_ALL)
522                         goto acc_check;
523                 if ((wh->type & DEV_BLOCK) && !S_ISBLK(inode->i_mode))
524                         continue;
525                 if ((wh->type & DEV_CHAR) && !S_ISCHR(inode->i_mode))
526                         continue;
527                 if (wh->major != ~0 && wh->major != imajor(inode))
528                         continue;
529                 if (wh->minor != ~0 && wh->minor != iminor(inode))
530                         continue;
531 acc_check:
532                 if ((mask & MAY_WRITE) && !(wh->access & ACC_WRITE))
533                         continue;
534                 if ((mask & MAY_READ) && !(wh->access & ACC_READ))
535                         continue;
536                 spin_unlock(&dev_cgroup->lock);
537                 return 0;
538         }
539         spin_unlock(&dev_cgroup->lock);
540
541         return -EPERM;
542 }
543
544 int devcgroup_inode_mknod(int mode, dev_t dev)
545 {
546         struct cgroup *cgroup;
547         struct dev_cgroup *dev_cgroup;
548         struct dev_whitelist_item *wh;
549
550         cgroup = task_cgroup(current, devices_subsys.subsys_id);
551         dev_cgroup = cgroup_to_devcgroup(cgroup);
552         if (!dev_cgroup)
553                 return 0;
554
555         spin_lock(&dev_cgroup->lock);
556         list_for_each_entry(wh, &dev_cgroup->whitelist, list) {
557                 if (wh->type & DEV_ALL)
558                         goto acc_check;
559                 if ((wh->type & DEV_BLOCK) && !S_ISBLK(mode))
560                         continue;
561                 if ((wh->type & DEV_CHAR) && !S_ISCHR(mode))
562                         continue;
563                 if (wh->major != ~0 && wh->major != MAJOR(dev))
564                         continue;
565                 if (wh->minor != ~0 && wh->minor != MINOR(dev))
566                         continue;
567 acc_check:
568                 if (!(wh->access & ACC_MKNOD))
569                         continue;
570                 spin_unlock(&dev_cgroup->lock);
571                 return 0;
572         }
573         spin_unlock(&dev_cgroup->lock);
574         return -EPERM;
575 }