projects / mirror_ubuntu-bionic-kernel.git / blame
| Commit | Line | Data |
|---|---|---|
| b2441318 | 1 | /* SPDX-License-Identifier: GPL-2.0 */ |
| 08ce5f16 | 2 | #include <linux/fs.h> |
| ebc614f6 | 3 | #include <linux/bpf-cgroup.h> |
| 08ce5f16 | 4 | |
| ecf8fecb RG |
5 | #define DEVCG_ACC_MKNOD 1 |
| 6 | #define DEVCG_ACC_READ 2 | |
| 7 | #define DEVCG_ACC_WRITE 4 | |
| 8 | #define DEVCG_ACC_MASK (DEVCG_ACC_MKNOD | DEVCG_ACC_READ | DEVCG_ACC_WRITE) | |
| 9 | ||
| 10 | #define DEVCG_DEV_BLOCK 1 | |
| 11 | #define DEVCG_DEV_CHAR 2 | |
| 12 | #define DEVCG_DEV_ALL 4 /* this represents all devices */ | |
| 13 | ||
| 14 | #ifdef CONFIG_CGROUP_DEVICE | |
| 15 | extern int __devcgroup_check_permission(short type, u32 major, u32 minor, | |
| 16 | short access); | |
| 17 | #else | |
| 18 | static inline int __devcgroup_check_permission(short type, u32 major, u32 minor, | |
| 19 | short access) | |
| 20 | { return 0; } | |
| 21 | #endif | |
| 22 | ||
| ebc614f6 | 23 | #if defined(CONFIG_CGROUP_DEVICE) || defined(CONFIG_CGROUP_BPF) |
| ecf8fecb RG |
24 | static inline int devcgroup_check_permission(short type, u32 major, u32 minor, |
| 25 | short access) | |
| 26 | { | |
| ebc614f6 RG |
27 | int rc = BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type, major, minor, access); |
| 28 | ||
| 29 | if (rc) | |
| 30 | return -EPERM; | |
| 31 | ||
| ecf8fecb RG |
32 | return __devcgroup_check_permission(type, major, minor, access); |
| 33 | } | |
| 34 | ||
| 482e0cd3 AV |
35 | static inline int devcgroup_inode_permission(struct inode *inode, int mask) |
| 36 | { | |
| ecf8fecb RG |
37 | short type, access = 0; |
| 38 | ||
| 482e0cd3 AV |
39 | if (likely(!inode->i_rdev)) |
| 40 | return 0; | |
| ecf8fecb RG |
41 | |
| 42 | if (S_ISBLK(inode->i_mode)) | |
| 43 | type = DEVCG_DEV_BLOCK; | |
| 44 | else if (S_ISCHR(inode->i_mode)) | |
| 45 | type = DEVCG_DEV_CHAR; | |
| 46 | else | |
| 482e0cd3 | 47 | return 0; |
| ecf8fecb RG |
48 | |
| 49 | if (mask & MAY_WRITE) | |
| 50 | access |= DEVCG_ACC_WRITE; | |
| 51 | if (mask & MAY_READ) | |
| 52 | access |= DEVCG_ACC_READ; | |
| 53 | ||
| 54 | return devcgroup_check_permission(type, imajor(inode), iminor(inode), | |
| 55 | access); | |
| 482e0cd3 | 56 | } |
| ecf8fecb RG |
57 | |
| 58 | static inline int devcgroup_inode_mknod(int mode, dev_t dev) | |
| 59 | { | |
| 60 | short type; | |
| 61 | ||
| 62 | if (!S_ISBLK(mode) && !S_ISCHR(mode)) | |
| 63 | return 0; | |
| 64 | ||
| 65 | if (S_ISBLK(mode)) | |
| 66 | type = DEVCG_DEV_BLOCK; | |
| 67 | else | |
| 68 | type = DEVCG_DEV_CHAR; | |
| 69 | ||
| 70 | return devcgroup_check_permission(type, MAJOR(dev), MINOR(dev), | |
| 71 | DEVCG_ACC_MKNOD); | |
| 72 | } | |
| 73 | ||
| 08ce5f16 SH |
74 | #else |
| 75 | static inline int devcgroup_inode_permission(struct inode *inode, int mask) | |
| 76 | { return 0; } | |
| 77 | static inline int devcgroup_inode_mknod(int mode, dev_t dev) | |
| 78 | { return 0; } | |
| 79 | #endif |