Moving more extensive explanations to the end of the comment.
Showing the changes to security (1 of 1 file). Show all
Unified · Split
| @@ -306,17 +306,17 @@ static int devcgroup_seq_show(struct seq_file *m, void *v) · 305 unmodified lines | ||
| 306 | 306 | } |
| 307 | 307 | |
| 308 | 308 | /** |
| 309 | − * match_exception - iterates the exception list trying to match a rule | |
| 310 | − * based on type, major, minor and access type. It is | |
| 311 | − * considered a match if an exception is found that | |
| 312 | − * will contain the entire range of provided parameters. | |
| 309 | + * match_exception - iterates the exception list trying to find a complete match | |
| 313 | 310 | * @exceptions: list of exceptions |
| 314 | 311 | * @type: device type (DEV_BLOCK or DEV_CHAR) |
| 315 | 312 | * @major: device file major number, ~0 to match all |
| 316 | 313 | * @minor: device file minor number, ~0 to match all |
| 317 | 314 | * @access: permission mask (ACC_READ, ACC_WRITE, ACC_MKNOD) |
| 318 | 315 | * |
| 319 | − * returns: true in case it matches an exception completely | |
| 316 | + * It is considered a complete match if an exception is found that will | |
| 317 | + * contain the entire range of provided parameters. | |
| 318 | + * | |
| 319 | + * Return: true in case it matches an exception completely | |
| 320 | 320 | */ |
| 321 | 321 | static bool match_exception(struct list_head *exceptions, short type, |
| 322 | 322 | u32 major, u32 minor, short access) |
| @@ -341,20 +341,19 @@ static bool match_exception(struct list_head *exceptions, short type, · 18 unmodified lines | ||
| 341 | 341 | } |
| 342 | 342 | |
| 343 | 343 | /** |
| 344 | − * match_exception_partial - iterates the exception list trying to match a rule | |
| 345 | − * based on type, major, minor and access type. It is | |
| 346 | − * considered a match if an exception's range is | |
| 347 | − * found to contain *any* of the devices specified by | |
| 348 | − * provided parameters. This is used to make sure no | |
| 349 | − * extra access is being granted that is forbidden by | |
| 350 | − * any of the exception list. | |
| 344 | + * match_exception_partial - iterates the exception list trying to find a partial match | |
| 351 | 345 | * @exceptions: list of exceptions |
| 352 | 346 | * @type: device type (DEV_BLOCK or DEV_CHAR) |
| 353 | 347 | * @major: device file major number, ~0 to match all |
| 354 | 348 | * @minor: device file minor number, ~0 to match all |
| 355 | 349 | * @access: permission mask (ACC_READ, ACC_WRITE, ACC_MKNOD) |
| 356 | 350 | * |
| 357 | − * returns: true in case the provided range mat matches an exception completely | |
| 351 | + * It is considered a partial match if an exception's range is found to | |
| 352 | + * contain *any* of the devices specified by provided parameters. This is | |
| 353 | + * used to make sure no extra access is being granted that is forbidden by | |
| 354 | + * any of the exception list. | |
| 355 | + * | |
| 356 | + * Return: true in case the provided range mat matches an exception completely | |
| 358 | 357 | */ |
| 359 | 358 | static bool match_exception_partial(struct list_head *exceptions, short type, |
| 360 | 359 | u32 major, u32 minor, short access) |
| @@ -387,13 +386,13 @@ static bool match_exception_partial(struct list_head *exceptions, short type, · 26 unmodified lines | ||
| 387 | 386 | } |
| 388 | 387 | |
| 389 | 388 | /** |
| 390 | − * verify_new_ex - verifies if a new exception is part of what is allowed | |
| 391 | − * by a dev cgroup based on the default policy + | |
| 392 | − * exceptions. This is used to make sure a child cgroup | |
| 393 | − * won't have more privileges than its parent | |
| 389 | + * verify_new_ex - verifies if a new exception is allowed by parent cgroup's permissions | |
| 394 | 390 | * @dev_cgroup: dev cgroup to be tested against |
| 395 | 391 | * @refex: new exception |
| 396 | 392 | * @behavior: behavior of the exception's dev_cgroup |
| 393 | + * | |
| 394 | + * This is used to make sure a child cgroup won't have more privileges | |
| 395 | + * than its parent | |
| 397 | 396 | */ |
| 398 | 397 | static bool verify_new_ex(struct dev_cgroup *dev_cgroup, |
| 399 | 398 | struct dev_exception_item *refex, |