On Thu, Nov 29, 2012 at 08:26:08PM +0000, Serge E. Hallyn wrote:

Quoting Aristeu Rozanski (aris-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org):

quoted

I see your point. it's indeed a problem. in dev_exception_add(), it
needs to check for permissions before actually adding to
devcgroup->exceptions.

actually, checked again, it's done correctly. when adding an exception
that will allow extra device access (DEVCG_ALLOW), it does check it
before. It means that you can't add local exceptions unless at a certain
point of the time it was allowed to do so.

quoted

quoted

(Btw is there a git tree or gitweb view I could look at alongside
the patchset?)

I'll rebase the patchset along with a fix for this and resubmit with a
link to the git repo.

just pushed the same version to:
git://github.com/aristeu/linux-2.6.git

please use branch devcg_hiearchy_review

-- 
Aristeu