From cce78bc02ff0ea2d21e88e3438d65272b898aa35 Mon Sep 17 00:00:00 2001 From: Rom Lemarchand Date: Fri, 7 Nov 2014 09:42:40 -0800 Subject: [PATCH] memcg: add permission check Use the 'allow_attach' handler for the 'mem' cgroup to allow non-root processes to add arbitrary processes to a 'mem' cgroup if it has the CAP_SYS_NICE capability set. Bug: 18260435 Change-Id: If7d37bf90c1544024c4db53351adba6a64966250 Signed-off-by: Rom Lemarchand --- mm/memcontrol.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 194721839cf5..338d62a05200 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -6753,6 +6753,12 @@ static int mem_cgroup_can_attach(struct cgroup *cgroup, return ret; } +static int mem_cgroup_allow_attach(struct cgroup *cgroup, + struct cgroup_taskset *tset) +{ + return subsys_cgroup_allow_attach(cgroup, tset); +} + static void mem_cgroup_cancel_attach(struct cgroup *cgroup, struct cgroup_taskset *tset) { @@ -6921,6 +6927,11 @@ static int mem_cgroup_can_attach(struct cgroup *cgroup, { return 0; } +static int mem_cgroup_allow_attach(struct cgroup *cgroup, + struct cgroup_taskset *tset) +{ + return 0; +} static void mem_cgroup_cancel_attach(struct cgroup *cgroup, struct cgroup_taskset *tset) { @@ -6956,6 +6967,7 @@ struct cgroup_subsys mem_cgroup_subsys = { .can_attach = mem_cgroup_can_attach, .cancel_attach = mem_cgroup_cancel_attach, .attach = mem_cgroup_move_task, + .allow_attach = mem_cgroup_allow_attach, .bind = mem_cgroup_bind, .base_cftypes = mem_cgroup_files, .early_init = 0, -- 2.34.1