From e6f5c0c0ec80c5f4c029499e987f9daba9dcc3ad Mon Sep 17 00:00:00 2001 From: Rom Lemarchand Date: Fri, 7 Nov 2014 09:42:40 -0800 Subject: [PATCH] memcg: add permission check Use the 'allow_attach' handler for the 'mem' cgroup to allow non-root processes to add arbitrary processes to a 'mem' cgroup if it has the CAP_SYS_NICE capability set. Bug: 18260435 Change-Id: If7d37bf90c1544024c4db53351adba6a64966250 Signed-off-by: Rom Lemarchand --- mm/memcontrol.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index fc10620967c7..f98ed648cb58 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4878,6 +4878,12 @@ static int mem_cgroup_can_attach(struct cgroup_taskset *tset) return ret; } +static int mem_cgroup_allow_attach(struct cgroup_subsys_state *css, + struct cgroup_taskset *tset) +{ + return subsys_cgroup_allow_attach(css->cgroup, tset); +} + static void mem_cgroup_cancel_attach(struct cgroup_taskset *tset) { if (mc.to) @@ -5039,6 +5045,11 @@ static int mem_cgroup_can_attach(struct cgroup_taskset *tset) { return 0; } +static int mem_cgroup_allow_attach(struct cgroup_subsys_state *css, + struct cgroup_taskset *tset) +{ + return 0; +} static void mem_cgroup_cancel_attach(struct cgroup_taskset *tset) { } @@ -5222,6 +5233,7 @@ struct cgroup_subsys memory_cgrp_subsys = { .can_attach = mem_cgroup_can_attach, .cancel_attach = mem_cgroup_cancel_attach, .attach = mem_cgroup_move_task, + .allow_attach = mem_cgroup_allow_attach, .bind = mem_cgroup_bind, .dfl_cftypes = memory_files, .legacy_cftypes = mem_cgroup_legacy_files, -- 2.34.1