Messages in this thread | | | Date | Fri, 14 Mar 2008 02:16:46 -0700 | From | "Paul Menage" <> | Subject | Re: [RFC] cgroups: implement device whitelist lsm (v2) |
| |
On Wed, Mar 12, 2008 at 8:27 PM, Serge E. Hallyn <serue@us.ibm.com> wrote: > > While composing this with the ns_cgroup may seem logical, it is not > the right thing to do, because updates to /cg/cg1/devcg.deny are > not reflected in /cg/cg1/cg2/devcg.allow.
Maybe you should follow up the tree to ensure that all parent groups have access to the device too? Or alternatively, cache the results of this lookup whenever permissions for a device change?
> > A task may only be moved to another devcgroup if it is moving to > a direct descendent of its current devcgroup.
What's the rationale for that?
> > CAP_NS_OVERRIDE is defined as the capability needed to cross namespaces. > A task needs both CAP_NS_OVERRIDE and CAP_SYS_ADMIN to create a new > devcgroup, update a devcgroup's access, or move a task to a new > devcgroup.
But this isn't necessarily crossing namespaces. It could be used for device control in the same namespace (e.g. allowing a job to access a raw disk for its data storage rather than going through the filesystem).
Paul
| |