lkml.org 
[lkml]   [2014]   [May]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RFC PATCH 11/11] loop: Allow priveleged operations for root in the namespace which owns a device
On Fri, May 23, 2014 at 08:48:25AM +0300, Marian Marinov wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> One question about this patch.
>
> Why don't you use the devices cgroup check if the root user in that namespace is allowed to use this device?
>
> This way you can be sure that the root in that namespace can not access devices to which the host system did not gave
> him access to.

That might be possible, but I don't want to require something on the
host to whitelist the device for the container. Then loop would need to
automatically add the device to devices.allow, which doesn't seem
desirable to me. But I'm not entirely opposed to the idea if others
think this is a better way to go.

Seth



\
 
 \ /
  Last update: 2014-05-26 11:41    [W:0.213 / U:0.540 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site