[lkml]   [2008]   [Mar]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [RFC] cgroups: implement device whitelist lsm (v2)
    On Fri, Mar 14, 2008 at 7:05 AM, Serge E. Hallyn <> wrote:
    > > > A task may only be moved to another devcgroup if it is moving to
    > > > a direct descendent of its current devcgroup.
    > >
    > > What's the rationale for that?
    > To prevent it escaping to laxer device permissions, which of course only
    > makes sense if we do what you recommend above :)

    That makes it impossible for a root process to enter a child cgroup,
    do something, and then go back to its own cgroup. Why aren't the
    existing cgroup security semantics sufficient?


     \ /
      Last update: 2008-03-14 15:19    [W:0.083 / U:12.124 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site