summaryrefslogtreecommitdiff
path: root/security
diff options
context:
space:
mode:
authorSerge Hallyn <serge.hallyn@ubuntu.com>2013-10-23 01:34:00 +0200
committerTejun Heo <tj@kernel.org>2013-10-24 06:56:56 -0400
commit73ba353471e0b692f398f3d63018b7f46ccf1d3e (patch)
tree132a9cc3ca7d329adb0b3f54d9b7f086db388f7f /security
parent2ff2a7d03bbe472ed44a8380dbdbea490d81c59d (diff)
device_cgroup: remove can_attach
It is really only wanting to duplicate a check which is already done by the cgroup subsystem. With this patch, user jdoe still cannot move pid 1 into a devices cgroup he owns, but now he can move his own other tasks into devices cgroups. Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: Tejun Heo <tj@kernel.org> Cc: Aristeu Rozanski <aris@redhat.com>
Diffstat (limited to 'security')
-rw-r--r--security/device_cgroup.c11
1 files changed, 0 insertions, 11 deletions
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index c123628d3f84..7c2a0a71049e 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -63,16 +63,6 @@ static inline struct dev_cgroup *task_devcgroup(struct task_struct *task)
struct cgroup_subsys devices_subsys;
-static int devcgroup_can_attach(struct cgroup_subsys_state *new_css,
- struct cgroup_taskset *set)
-{
- struct task_struct *task = cgroup_taskset_first(set);
-
- if (current != task && !capable(CAP_SYS_ADMIN))
- return -EPERM;
- return 0;
-}
-
/*
* called under devcgroup_mutex
*/
@@ -697,7 +687,6 @@ static struct cftype dev_cgroup_files[] = {
struct cgroup_subsys devices_subsys = {
.name = "devices",
- .can_attach = devcgroup_can_attach,
.css_alloc = devcgroup_css_alloc,
.css_free = devcgroup_css_free,
.css_online = devcgroup_online,