path: root/security/device_cgroup.c
diff options
authorHarish Kasiviswanathan <>2019-05-16 11:37:16 -0400
committerAlex Deucher <>2019-10-07 15:11:38 -0500
commit4b7d4d453fc46769394e31d1cb19088f49897b59 (patch)
treeb485d348084855efa543562edf5f157a36e7f3f8 /security/device_cgroup.c
parenta3e520a25ce85f84a7f589af2b6ec38af96caa12 (diff)
device_cgroup: Export devcgroup_check_permission
For AMD compute (amdkfd) driver. All AMD compute devices are exported via single device node /dev/kfd. As a result devices cannot be controlled individually using device cgroup. AMD compute devices will rely on its graphics counterpart that exposes /dev/dri/renderN node for each device. For each task (based on its cgroup), KFD driver will check if /dev/dri/renderN node is accessible before exposing it. Signed-off-by: Harish Kasiviswanathan <> Acked-by: Tejun Heo <> Acked-by: Felix Kuehling <> Reviewed-by: Roman Gushchin <> Signed-off-by: Alex Deucher <>
Diffstat (limited to 'security/device_cgroup.c')
1 files changed, 13 insertions, 2 deletions
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index 725674f3276d..7d0f8f7431ff 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -801,8 +801,8 @@ struct cgroup_subsys devices_cgrp_subsys = {
* returns 0 on success, -EPERM case the operation is not permitted
-int __devcgroup_check_permission(short type, u32 major, u32 minor,
- short access)
+static int __devcgroup_check_permission(short type, u32 major, u32 minor,
+ short access)
struct dev_cgroup *dev_cgroup;
bool rc;
@@ -824,3 +824,14 @@ int __devcgroup_check_permission(short type, u32 major, u32 minor,
return 0;
+int devcgroup_check_permission(short type, u32 major, u32 minor, short access)
+ int rc = BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type, major, minor, access);
+ if (rc)
+ return -EPERM;
+ return __devcgroup_check_permission(type, major, minor, access);