30  * exception list locking rules:
154  * dev_exception_clean - frees all entries of the exception list
155  * @dev_cgroup: dev_cgroup with the exception list to be cleaned
304  * match_exception	- iterates the exception list trying to find a complete match
311  * It is considered a complete match if an exception is found that will
314  * Return: true in case it matches an exception completely
330 		/* provided access cannot have more than the exception rule */  in match_exception()
339  * match_exception_partial - iterates the exception list trying to find a partial match
346  * It is considered a partial match if an exception's range is found to
349  * any of the exception list.
351  * Return: true in case the provided range mat matches an exception completely
365 		 * We must be sure that both the exception and the provided  in match_exception_partial()
374 		 * an exception, all its access bits shouldn't match the  in match_exception_partial()
375 		 * exception's access bits  in match_exception_partial()
385  * verify_new_ex - verifies if a new exception is allowed by parent cgroup's permissions
387  * @refex: new exception
388  * @behavior: behavior of the exception's dev_cgroup
406 			 * new exception in the child doesn't matter, only  in verify_new_ex()
412 			 * new exception in the child will add more devices  in verify_new_ex()
429 		 * the new exception will add access to more devices and must  in verify_new_ex()
430 		 * be contained completely in an parent's exception to be  in verify_new_ex()
438 			/* parent has an exception that matches the proposed */  in verify_new_ex()
448  * when adding a new allow rule to a device exception list, the rule
462  * parent_allows_removal - verify if it's ok to remove an exception
463  * @childcg: child cgroup from where the exception will be removed
464  * @ex: exception being removed
466  * When removing an exception in cgroups with default ALLOW policy, it must
470  * Return: true if it's ok to remove exception, false otherwise
485 	 * Make sure you're not removing part or a whole exception existing in  in parent_allows_removal()
506  * revalidate_active_exceptions - walks through the active exception list and
515  * exceptions due to a parent's exception change.
531  * propagate_exception - propagates a new exception to the children
532  * @devcg_root: device cgroup that added a new exception
533  * @ex: new exception to be propagated
561 		 * restriction means adding to the exception list  in propagate_exception()
573 			 * the exception will be removed  in propagate_exception()
587  * Modify the exception list using allow/deny rules.
590  * modify the exception list.
593  * device exception list controls, but for now we'll stick with CAP_SYS_ADMIN
722 		 * an matching exception instead. And be silent about it: we  in devcgroup_update_access()
740 		 * an matching exception instead. And be silent about it: we  in devcgroup_update_access()
821 		/* Need to match completely one exception to be allowed */  in devcgroup_legacy_check_permission()