Messages in this thread | | | Date | Thu, 13 Mar 2008 09:38:03 -0500 | From | "Serge E. Hallyn" <> | Subject | Re: [RFC] cgroups: implement device whitelist lsm (v2) |
| |
Quoting James Morris (jmorris@namei.org): > On Thu, 13 Mar 2008, Serge E. Hallyn wrote: > > > That does make for a simpler implementation at this point, however if > > any other such LSMs come along (as Casey seemed to think they would) the > > end result could end up being horrible spaghetti code of dependencies > > and interrelated configs. > > That can be addressed as the need arises. A basic tenet of kernel > development is to avoid speculative infrastructure.
True, but while this change simplifies the code a bit, the semantics seem more muddled - devcg will be enforcing when CONFIG_CGROUP_DEV=y and:
SECURITY=n or rootplug is enabled capabilities is enabled smack is enabled selinux+capabilities is enabled
It will not be enforcing when dummy is loaded only selinux (and not capabilities) is loaded
If that's ok with people then I'm fine with it. I suppose it should be explained in the CONFIG_CGROUP_DEV help section, which it isn't in this version I'm about to set. Patch hitting the wire in a minute.
thanks, -serge
> > But OTOH we went years with no such changes, so that's probably not a > > particularly practical concern unless someone can cite specific upcoming > > examples. So if noone objects I'll try that approach. > > -- > James Morris > <jmorris@namei.org>
| |