lkml.org 
[lkml]   [2012]   [Sep]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Controlling devices and device namespaces
On 09/16/2012 07:17 AM, Eric W. Biederman wrote:
> ebiederm@xmission.com (Eric W. Biederman) writes:
>
>> Alan Cox <alan@lxorguk.ukuu.org.uk> writes:
>>
>>>> One piece of the puzzle is that we should be able to allow unprivileged
>>>> device node creation and access for any device on any filesystem
>>>> for which it unprivileged access is safe.
>>>
>>> Which devices are "safe" is policy for all interesting and useful cases,
>>> as are file permissions, security tags, chroot considerations and the
>>> like.
>>>
>>> It's a complete non starter.
>
> Come to think of it mknod is completely unnecessary.
>
> Without mknod. Without being able to mount filesystems containing
> device nodes.

Hm? That sounds like it will really upset init/udev/upgrades in the
container.

Are you saying all filesystems containing device nodes will need to be
mounted in advance by the process setting up the container?

> The mount namespace is sufficient to prevent all of the
> cases that the device control group prevents (open and mknod on device
> nodes).
>
> So I honestly think the device control group is superflous, and it is
> probably wise to deprecate it and move to a model where it does not
> exist.
>
> Eric
>

That's what I said a few emails ago :) The device cgroup was meant as a
short-term workaround for lack of user (and device) namespaces.


\
 
 \ /
  Last update: 2012-09-16 16:21    [W:0.795 / U:0.180 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site