• Aristeu Rozanski's avatar
    devcg: propagate local changes down the hierarchy · bd2953eb
    Aristeu Rozanski authored
    This patch makes exception changes to propagate down in hierarchy respecting
    when possible local exceptions.
    New exceptions allowing additional access to devices won't be propagated, but
    it'll be possible to add an exception to access all of part of the newly
    allowed device(s).
    New exceptions disallowing access to devices will be propagated down and the
    local group's exceptions will be revalidated for the new situation.
         / \
        group        behavior          exceptions
        A            allow             "b 8:* rwm", "c 116:1 rw"
        B            deny              "c 1:3 rwm", "c 116:2 rwm", "b 3:* rwm"
    If a new exception is added to group A:
    	# echo "c 116:* r" > A/devices.deny
    it'll propagate down and after revalidating B's local exceptions, the exception
    "c 116:2 rwm" will be removed.
    In case parent's exceptions change and local exceptions are not allowed anymore,
    they'll be deleted.
    - do not allow behavior change when the cgroup has children
    - update documentation
    v6: fixed issues pointed by Serge Hallyn
    - only copy parent's exceptions while propagating behavior if the local
      behavior is different
    - while propagating exceptions, do not clear and copy parent's: it'd be against
      the premise we don't propagate access to more devices
    v5: fixed issues pointed by Serge Hallyn
    - updated documentation
    - not propagating when an exception is written to devices.allow
    - when propagating a new behavior, clean the local exceptions list if they're
      for a different behavior
    v4: fixed issues pointed by Tejun Heo
    - separated function to walk the tree and collect valid propagation targets
    v3: fixed issues pointed by Tejun Heo
    - update documentation
    - move css_online/css_offline changes to a new patch
    - use cgroup_for_each_descendant_pre() instead of own descendant walk
    - move exception_copy rework to a separared patch
    - move exception_clean rework to a separated patch
    v2: fixed issues pointed by Tejun Heo
    - instead of keeping the local settings that won't apply anymore, remove them
    Cc: Tejun Heo <tj@kernel.org>
    Cc: Serge Hallyn <serge.hallyn@canonical.com>
    Signed-off-by: default avatarAristeu Rozanski <aris@redhat.com>
    Signed-off-by: default avatarTejun Heo <tj@kernel.org>
device_cgroup.c 19.4 KB