verify_new_ex(9)

✨ NAME ✨

verify_new_ex(9) from the Kernel API Manual is the function that verifies if a new exception is allowed by parent cgroup's permissions. 💖

💅 SYNOPSIS 💅

bool verify_new_ex (struct dev_cgroup *dev_cgroup , struct
       dev_exception_item *refex , enum devcg_behavior behavior );

🦋 ARGUMENTS 🦋

• dev_cgroup — the dev cgroup to be tested against, bestie. 🫶
• refex — the new exception, aka the thing getting checked. ✨
• behavior — the behavior of the exception's dev_cgroup. 👑

🌸 DESCRIPTION 🌸

This is used to make sure a child cgroup won't have more privileges than its parent. Literally the permission vibe check. 🔥

🌈 SEE ALSO 🌈

Kernel file: ./security/device_cgroup.c 💅

• dev_exception_clean(9)
• devcgroup_online(9)
• match_exception(9)
• match_exception_partial(9)
• parent_allows_removal(9)
• may_allow_all(9)
• revalidate_active_exceptions(9)
• propagate_exception(9)
• devcgroup_legacy_check_permission(9)

Signed off from the ./security source/version corner, dated October 2026, for verify_new_ex(9) 💅✨