[Devel] [PATCH RH9 10/13] ve/device_cgroup: fake allowing all devices for docker inside VZCT

[Pavel Tikhomirov]

Docker from 1.7.0 tries to add "a" to devices.allow for newly created
privileged container device_cgroup, and thus to allow all devices in
docker container. Docker fails to do so because not all devices are
allowed in parent VZ6CT cgroup.

To support docker we must allow writing "a" to devices.allow in CT.
With this patch if we get "a", we will silently exit without EPERM.

https://jira.sw.ru/browse/PSBM-38691
https://jira.sw.ru/browse/PSBM-34529

Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>

(cherry-picked from vz8 commit 40a66b4a7eb511d2800f989bea9eed2563bc1f05)
Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
---
 security/device_cgroup.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index 3591e7144df4..bd1bf41b4a0d 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -618,8 +618,13 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
 			if (css_has_online_children(&devcgroup->css))
 				return -EINVAL;
 
-			if (!may_allow_all(parent))
-				return -EPERM;
+			if (!may_allow_all(parent)) {
+				if (ve_is_super(get_exec_env()))
+					return -EPERM;
+				else
+					/* Fooling docker in CT - silently exit */
+					return 0;
+			}
 			dev_exception_clean(devcgroup);
 			devcgroup->behavior = DEVCG_DEFAULT_ALLOW;
 			if (!parent)
-- 
2.31.1