X-Git-Url: https://git.ti.com/gitweb?p=android-sdk%2Fkernel-video.git;a=blobdiff_plain;f=kernel%2Fcgroup.c;h=f28c151d30cabe4d32855d1393cafc9f52c12f3c;hp=cddf1d9983812b2b4af28d7f87ab71105ef0e27d;hb=b49d9b996deb084dc16ad9040f52ef11958c514c;hpb=87ef7ce4bdfd5475e552aa37bf957e24e65ac370

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index cddf1d99838..f28c151d30c 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2186,6 +2186,24 @@ out_free_group_list:
 	return retval;
 }
 
+static int cgroup_allow_attach(struct cgroup *cgrp, struct cgroup_taskset *tset)
+{
+	struct cgroup_subsys *ss;
+	int ret;
+
+	for_each_subsys(cgrp->root, ss) {
+		if (ss->allow_attach) {
+			ret = ss->allow_attach(cgrp, tset);
+			if (ret)
+				return ret;
+		} else {
+			return -EACCES;
+		}
+	}
+
+	return 0;
+}
+
 /*
  * Find the task_struct of the task to attach by vpid and pass it along to the
  * function to attach either it or all tasks in its threadgroup. Will lock
@@ -2217,9 +2235,18 @@ retry_find_task:
 		if (!uid_eq(cred->euid, GLOBAL_ROOT_UID) &&
 		    !uid_eq(cred->euid, tcred->uid) &&
 		    !uid_eq(cred->euid, tcred->suid)) {
-			rcu_read_unlock();
-			ret = -EACCES;
-			goto out_unlock_cgroup;
+			/*
+			 * if the default permission check fails, give each
+			 * cgroup a chance to extend the permission check
+			 */
+			struct cgroup_taskset tset = { };
+			tset.single.task = tsk;
+			tset.single.cgrp = cgrp;
+			ret = cgroup_allow_attach(cgrp, &tset);
+			if (ret) {
+				rcu_read_unlock();
+				goto out_unlock_cgroup;
+			}
 		}
 	} else
 		tsk = current;