Messages in this thread | | | Date | Sun, 16 Mar 2008 08:57:36 +0800 | From | "Paul Menage" <> | Subject | Re: [RFC] cgroups: implement device whitelist lsm (v2) |
| |
On Fri, Mar 14, 2008 at 10:35 PM, Serge E. Hallyn <serue@us.ibm.com> wrote: > > > Why aren't the > > existing cgroup security semantics sufficient? > > Because the point of this is to provide some restrictions to otherwise > privileged users, and cgroups only provides dac-based permissions. > > But that doesn't mean that I'm not doing too much. I could just add a > CAP_SYS_ADMIN or CAP_CONT_OVERRIDE+CAP_SYS_ADMIN check, and not restrict > which cgroups a task can move to. Does that sound good?
Sounds reasonable.
Paul
| |