diff options
| author | Arnd Bergmann <arnd@arndb.de> | 2012-10-04 22:57:00 +0200 |
|---|---|---|
| committer | Arnd Bergmann <arnd@arndb.de> | 2012-10-04 22:57:51 +0200 |
| commit | c37d6154c0b9163c27e53cc1d0be3867b4abd760 (patch) | |
| tree | 7a24522c56d1cb284dff1d3c225bbdaba0901bb5 /security/device_cgroup.c | |
| parent | e7a570ff7dff9af6e54ff5e580a61ec7652137a0 (diff) | |
| parent | 8a1ab3155c2ac7fbe5f2038d6e26efeb607a1498 (diff) | |
Merge branch 'disintegrate-asm-generic' of git://git.infradead.org/users/dhowells/linux-headers into asm-generic
Patches from David Howells <dhowells@redhat.com>:
This is to complete part of the UAPI disintegration for which the
preparatory patches were pulled recently.
Note that there are some fixup patches which are at the base of the
branch aimed at you, plus all arches get the asm-generic branch merged in too.
* 'disintegrate-asm-generic' of git://git.infradead.org/users/dhowells/linux-headers:
UAPI: (Scripted) Disintegrate include/asm-generic
UAPI: Fix conditional header installation handling (notably kvm_para.h on m68k)
c6x: remove c6x signal.h
UAPI: Split compound conditionals containing __KERNEL__ in Arm64
UAPI: Fix the guards on various asm/unistd.h files
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Diffstat (limited to 'security/device_cgroup.c')
| -rw-r--r-- | security/device_cgroup.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/security/device_cgroup.c b/security/device_cgroup.c index 442204cc22d..4b877a92a7e 100644 --- a/security/device_cgroup.c +++ b/security/device_cgroup.c @@ -457,6 +457,15 @@ struct cgroup_subsys devices_subsys = { .destroy = devcgroup_destroy, .subsys_id = devices_subsys_id, .base_cftypes = dev_cgroup_files, + + /* + * While devices cgroup has the rudimentary hierarchy support which + * checks the parent's restriction, it doesn't properly propagates + * config changes in ancestors to their descendents. A child + * should only be allowed to add more restrictions to the parent's + * configuration. Fix it and remove the following. + */ + .broken_hierarchy = true, }; int __devcgroup_inode_permission(struct inode *inode, int mask) |