From: Rom Lemarchand Date: Fri, 7 Nov 2014 17:42:40 +0000 (-0800) Subject: memcg: add permission check X-Git-Tag: firefly_0821_release~2958^2~168 X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=e6f5c0c0ec80c5f4c029499e987f9daba9dcc3ad;p=firefly-linux-kernel-4.4.55.git memcg: add permission check Use the 'allow_attach' handler for the 'mem' cgroup to allow non-root processes to add arbitrary processes to a 'mem' cgroup if it has the CAP_SYS_NICE capability set. Bug: 18260435 Change-Id: If7d37bf90c1544024c4db53351adba6a64966250 Signed-off-by: Rom Lemarchand --- diff --git a/mm/memcontrol.c b/mm/memcontrol.c index fc10620967c7..f98ed648cb58 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4878,6 +4878,12 @@ static int mem_cgroup_can_attach(struct cgroup_taskset *tset) return ret; } +static int mem_cgroup_allow_attach(struct cgroup_subsys_state *css, + struct cgroup_taskset *tset) +{ + return subsys_cgroup_allow_attach(css->cgroup, tset); +} + static void mem_cgroup_cancel_attach(struct cgroup_taskset *tset) { if (mc.to) @@ -5039,6 +5045,11 @@ static int mem_cgroup_can_attach(struct cgroup_taskset *tset) { return 0; } +static int mem_cgroup_allow_attach(struct cgroup_subsys_state *css, + struct cgroup_taskset *tset) +{ + return 0; +} static void mem_cgroup_cancel_attach(struct cgroup_taskset *tset) { } @@ -5222,6 +5233,7 @@ struct cgroup_subsys memory_cgrp_subsys = { .can_attach = mem_cgroup_can_attach, .cancel_attach = mem_cgroup_cancel_attach, .attach = mem_cgroup_move_task, + .allow_attach = mem_cgroup_allow_attach, .bind = mem_cgroup_bind, .dfl_cftypes = memory_files, .legacy_cftypes = mem_cgroup_legacy_files,