Messages in this thread | | | Date | Fri, 14 Mar 2008 02:18:10 -0700 | From | "Paul Menage" <> | Subject | Re: [RFC] cgroups: implement device whitelist lsm (v2) |
| |
On Wed, Mar 12, 2008 at 8:27 PM, Serge E. Hallyn <serue@us.ibm.com> wrote: > Implement a cgroup using the LSM interface to enforce mknod and open > on device files. > > This implements a simple device access whitelist. A whitelist entry > has 4 fields. 'type' is a (all), c (char), or b (block). 'all' means it > applies to all types, all major numbers, and all minor numbers. Major and > minor are obvious. Access is a composition of r (read), w (write), and > m (mknod). > > The root devcgroup starts with rwm to 'all'. A child devcg gets a copy > of the parent. Admins can then add and remove devices to the whitelist. > Once CAP_HOST_ADMIN is introduced it will be needed to add entries as > well or remove entries from another cgroup, though just CAP_SYS_ADMIN > will suffice to remove entries for your own group. > > An entry is added by doing "echo <type> <maj> <min> <access>" > devcg.allow, > for instance: > > echo b 7 0 mrw > /cgroups/1/devcg.allow > > An entry is removed by doing likewise into devcg.deny. Since this is a > pure whitelist, not acls, you can only remove entries which exist in the > whitelist. You must explicitly > > echo a 0 0 mrw > /cgroups/1/devcg.deny > > to remove the "allow all" entry which is automatically inherited from > the root cgroup.
In keeping with the naming convention for control groups, "devices" would be better than "devcg".
Paul
| |