diff options
| author | Rom Lemarchand <romlem@android.com> | 2014-11-07 12:48:17 -0800 |
|---|---|---|
| committer | John Stultz <john.stultz@linaro.org> | 2016-02-16 13:53:42 -0800 |
| commit | 6809864a2cc59332b246c183a2b78328f6aa551e (patch) | |
| tree | 2cc8352e9aec310ec205eb6468dd1c2f8b091eee /kernel | |
| parent | 1f027b30b538458d50fa7a40d0ef0ddfed8cd3f2 (diff) | |
cgroup: refactor allow_attach function into common code
move cpu_cgroup_allow_attach to a common subsys_cgroup_allow_attach.
This allows any process with CAP_SYS_NICE to move tasks across cgroups if
they use this function as their allow_attach handler.
Bug: 18260435
Change-Id: I6bb4933d07e889d0dc39e33b4e71320c34a2c90f
Signed-off-by: Rom Lemarchand <romlem@android.com>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/cgroup.c | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/kernel/cgroup.c b/kernel/cgroup.c index 470f6536b9e8..35591b841db2 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -2663,6 +2663,25 @@ static int cgroup_attach_task(struct cgroup *dst_cgrp, return ret; } +int subsys_cgroup_allow_attach(struct cgroup_subsys_state *css, struct cgroup_taskset *tset) +{ + const struct cred *cred = current_cred(), *tcred; + struct task_struct *task; + + if (capable(CAP_SYS_NICE)) + return 0; + + cgroup_taskset_for_each(task, css, tset) { + tcred = __task_cred(task); + + if (current != task && !uid_eq(cred->euid, tcred->uid) && + !uid_eq(cred->euid, tcred->suid)) + return -EACCES; + } + + return 0; +} + static int cgroup_procs_write_permission(struct task_struct *task, struct cgroup *dst_cgrp, struct kernfs_open_file *of) |