Messages in this thread | | | Date | Sun, 16 Sep 2012 08:32:01 -0500 | From | Serge Hallyn <> | Subject | Re: Controlling devices and device namespaces |
| |
On 09/16/2012 07:17 AM, Eric W. Biederman wrote: > ebiederm@xmission.com (Eric W. Biederman) writes: > >> Alan Cox <alan@lxorguk.ukuu.org.uk> writes: >> >>>> One piece of the puzzle is that we should be able to allow unprivileged >>>> device node creation and access for any device on any filesystem >>>> for which it unprivileged access is safe. >>> >>> Which devices are "safe" is policy for all interesting and useful cases, >>> as are file permissions, security tags, chroot considerations and the >>> like. >>> >>> It's a complete non starter. > > Come to think of it mknod is completely unnecessary. > > Without mknod. Without being able to mount filesystems containing > device nodes.
Hm? That sounds like it will really upset init/udev/upgrades in the container.
Are you saying all filesystems containing device nodes will need to be mounted in advance by the process setting up the container?
> The mount namespace is sufficient to prevent all of the > cases that the device control group prevents (open and mknod on device > nodes). > > So I honestly think the device control group is superflous, and it is > probably wise to deprecate it and move to a model where it does not > exist. > > Eric >
That's what I said a few emails ago :) The device cgroup was meant as a short-term workaround for lack of user (and device) namespaces.
| |