Revert "cgroup: refactor allow_attach handler for 4.4"
This reverts commit 72838bb94b0ded15cadc0ecbf0c3e07428ec9320.
Part of Chromium commit series:
CHROMIUM: remove Android's cgroup generic permissions checks
The implementation is utterly broken, resulting in all processes being
allows to move tasks between sets (as long as they have access to the
"tasks" attribute), and upstream is heading towards checking only
capability anyway, so let's get rid of this code.
BUG=b:31790445,chromium:647994
TEST=Boot android container, examine logcat
Signed-off-by: Dmitry Torokhov <dtor@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/394967
Reviewed-by: Ricky Zhou <rickyz@chromium.org>
Reviewed-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
index ae15de9..72e4d67 100644
--- a/include/linux/cgroup-defs.h
+++ b/include/linux/cgroup-defs.h
@@ -427,7 +427,8 @@
void (*css_reset)(struct cgroup_subsys_state *css);
void (*css_e_css_changed)(struct cgroup_subsys_state *css);
- int (*allow_attach)(struct cgroup_taskset *tset);
+ int (*allow_attach)(struct cgroup_subsys_state *css,
+ struct cgroup_taskset *tset);
int (*can_attach)(struct cgroup_taskset *tset);
void (*cancel_attach)(struct cgroup_taskset *tset);
void (*attach)(struct cgroup_taskset *tset);
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index 41ebe10..c96e20e 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -533,7 +533,8 @@
* running as root.
* Returns 0 if this is allowed, or -EACCES otherwise.
*/
-int subsys_cgroup_allow_attach(struct cgroup_taskset *tset);
+int subsys_cgroup_allow_attach(struct cgroup_subsys_state *css,
+ struct cgroup_taskset *tset);
#else /* !CONFIG_CGROUPS */
@@ -560,7 +561,8 @@
static inline int cgroup_init_early(void) { return 0; }
static inline int cgroup_init(void) { return 0; }
-static inline int subsys_cgroup_allow_attach(void *tset)
+static inline int subsys_cgroup_allow_attach(struct cgroup_subsys_state *css,
+ void *tset)
{
return -EINVAL;
}
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index b90f6e0..b249e67 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2661,16 +2661,15 @@
return ret;
}
-int subsys_cgroup_allow_attach(struct cgroup_taskset *tset)
+int subsys_cgroup_allow_attach(struct cgroup_subsys_state *css, struct cgroup_taskset *tset)
{
const struct cred *cred = current_cred(), *tcred;
struct task_struct *task;
- struct cgroup_subsys_state *css;
if (capable(CAP_SYS_NICE))
return 0;
- cgroup_taskset_for_each(task, css, tset) {
+ cgroup_taskset_for_each(task, tset) {
tcred = __task_cred(task);
if (current != task && !uid_eq(cred->euid, tcred->uid) &&
@@ -2689,7 +2688,7 @@
for_each_css(css, i, cgrp) {
if (css->ss->allow_attach) {
- ret = css->ss->allow_attach(tset);
+ ret = css->ss->allow_attach(css, tset);
if (ret)
return ret;
} else {
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index a860dfe..407a973 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4895,9 +4895,10 @@
return ret;
}
-static int mem_cgroup_allow_attach(struct cgroup_taskset *tset)
+static int mem_cgroup_allow_attach(struct cgroup_subsys_state *css,
+ struct cgroup_taskset *tset)
{
- return subsys_cgroup_allow_attach(tset);
+ return subsys_cgroup_allow_attach(css, tset);
}
static void mem_cgroup_cancel_attach(struct cgroup_taskset *tset)
@@ -5061,7 +5062,8 @@
{
return 0;
}
-static int mem_cgroup_allow_attach(struct cgroup_taskset *tset)
+static int mem_cgroup_allow_attach(struct cgroup_subsys_state *css,
+ struct cgroup_taskset *tset)
{
return 0;
}