memcg: add permission check

Use the 'allow_attach' handler for the 'mem' cgroup to allow
non-root processes to add arbitrary processes to a 'mem' cgroup
if it has the CAP_SYS_NICE capability set.

Bug: 18260435
Change-Id: If7d37bf90c1544024c4db53351adba6a64966250
Signed-off-by: Rom Lemarchand <romlem@android.com>

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index fc10620967c79d7b8fbbcc0f82fd9804b1562f13..f98ed648cb5877ffda110d3dbca99ceb7b9b45a8 100644 (file)
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4878,6 +4878,12 @@ static int mem_cgroup_can_attach(struct cgroup_taskset *tset)
        return ret;
 }
 
+static int mem_cgroup_allow_attach(struct cgroup_subsys_state *css,
+                                  struct cgroup_taskset *tset)
+{
+       return subsys_cgroup_allow_attach(css->cgroup, tset);
+}
+
 static void mem_cgroup_cancel_attach(struct cgroup_taskset *tset)
 {
        if (mc.to)
@@ -5039,6 +5045,11 @@ static int mem_cgroup_can_attach(struct cgroup_taskset *tset)
 {
        return 0;
 }
+static int mem_cgroup_allow_attach(struct cgroup_subsys_state *css,
+                                  struct cgroup_taskset *tset)
+{
+       return 0;
+}
 static void mem_cgroup_cancel_attach(struct cgroup_taskset *tset)
 {
 }
@@ -5222,6 +5233,7 @@ struct cgroup_subsys memory_cgrp_subsys = {
        .can_attach = mem_cgroup_can_attach,
        .cancel_attach = mem_cgroup_cancel_attach,
        .attach = mem_cgroup_move_task,
+       .allow_attach = mem_cgroup_allow_attach,
        .bind = mem_cgroup_bind,
        .dfl_cftypes = memory_files,
        .legacy_cftypes = mem_cgroup_legacy_files,