Messages in this thread | | | Date | Thu, 27 Mar 2008 08:58:37 -0700 | From | Randy Dunlap <> | Subject | Re: [PATCH] cgroups: devices: add Documentation/ file |
| |
On Thu, 27 Mar 2008 10:12:27 -0500 Serge E. Hallyn wrote:
> Fill a Documentation/controllers/devices.txt file with a > modified text from the patch description. > > Signed-off-by: Serge E. Hallyn <serue@us.ibm.com> > --- > Documentation/controllers/devices.txt | 48 +++++++++++++++++++++++++++++++++ > 1 files changed, 48 insertions(+), 0 deletions(-) > create mode 100644 Documentation/controllers/devices.txt > > diff --git a/Documentation/controllers/devices.txt b/Documentation/controllers/devices.txt > new file mode 100644 > index 0000000..a157f53 > --- /dev/null > +++ b/Documentation/controllers/devices.txt > @@ -0,0 +1,48 @@ > +Device Whitelist Controller > + > +1. Description: > +
...
> +The root device cgroup starts with rwm to 'all'. A child devices
device's
> +cgroup gets a copy of the parent. Administrators can then remove > +devices from the whitelist or add new entries. A child cgroup can > +never receive a device access which is denied its parent. However > +when a device access is removed from a parent it will not also be > +removed from the child(ren). > + > +2. User Interface > + ... > + > +3. Security > + > +Any task can move itself between cgroups. This of clearly won't
s/of//
> +suffice, but we can decide the best way to adequately restrict > +movement as people get some experience with this. We may just want > +to require CAP_SYS_ADMIN, which at least is a separate bit from > +CAP_MKNOD. We may want to just refuse moving to a cgroup which > +isn't a descendent of the current one. Or we may want to use > +CAP_MAC_ADMIN, since we really are trying to lock down root. > + > +CAP_SYS_ADMIN is needed to modify the whitelist or move another > +task to a new cgroup. (Again we'll probably want to change that). > + > +A cgroup may not be granted more permissions than the cgroup's > +parent has. > --
--- ~Randy
| |