lkml.org 
[lkml]   [2008]   [Mar]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RFC] cgroups: implement device whitelist lsm (v2)
On Fri, Mar 14, 2008 at 7:05 AM, Serge E. Hallyn <serue@us.ibm.com> wrote:
> > > A task may only be moved to another devcgroup if it is moving to
> > > a direct descendent of its current devcgroup.
> >
> > What's the rationale for that?
>
> To prevent it escaping to laxer device permissions, which of course only
> makes sense if we do what you recommend above :)
>

That makes it impossible for a root process to enter a child cgroup,
do something, and then go back to its own cgroup. Why aren't the
existing cgroup security semantics sufficient?

Paul


\
 
 \ /
  Last update: 2008-03-14 15:19    [from the cache]
©2003-2011 Jasper Spaans