diff options
| author | Serge Hallyn <serge.hallyn@ubuntu.com> | 2013-10-23 01:34:00 +0200 |
|---|---|---|
| committer | Tejun Heo <tj@kernel.org> | 2013-10-24 12:56:56 +0200 |
| commit | 73ba353471e0b692f398f3d63018b7f46ccf1d3e (patch) | |
| tree | 132a9cc3ca7d329adb0b3f54d9b7f086db388f7f | |
| parent | cgroup: kill css_id (diff) | |
| download | linux-73ba353471e0b692f398f3d63018b7f46ccf1d3e.tar.xz linux-73ba353471e0b692f398f3d63018b7f46ccf1d3e.zip | |
device_cgroup: remove can_attach
It is really only wanting to duplicate a check which is already done by the
cgroup subsystem.
With this patch, user jdoe still cannot move pid 1 into a devices cgroup
he owns, but now he can move his own other tasks into devices cgroups.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Aristeu Rozanski <aris@redhat.com>
| -rw-r--r-- | security/device_cgroup.c | 11 |
1 files changed, 0 insertions, 11 deletions
diff --git a/security/device_cgroup.c b/security/device_cgroup.c index c123628d3f84..7c2a0a71049e 100644 --- a/security/device_cgroup.c +++ b/security/device_cgroup.c @@ -63,16 +63,6 @@ static inline struct dev_cgroup *task_devcgroup(struct task_struct *task) struct cgroup_subsys devices_subsys; -static int devcgroup_can_attach(struct cgroup_subsys_state *new_css, - struct cgroup_taskset *set) -{ - struct task_struct *task = cgroup_taskset_first(set); - - if (current != task && !capable(CAP_SYS_ADMIN)) - return -EPERM; - return 0; -} - /* * called under devcgroup_mutex */ @@ -697,7 +687,6 @@ static struct cftype dev_cgroup_files[] = { struct cgroup_subsys devices_subsys = { .name = "devices", - .can_attach = devcgroup_can_attach, .css_alloc = devcgroup_css_alloc, .css_free = devcgroup_css_free, .css_online = devcgroup_online, |