lkml.org 
[lkml]   [2008]   [Mar]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RFC] cgroups: implement device whitelist lsm (v2)
Quoting James Morris (jmorris@namei.org):
> On Thu, 13 Mar 2008, Serge E. Hallyn wrote:
>
> > That does make for a simpler implementation at this point, however if
> > any other such LSMs come along (as Casey seemed to think they would) the
> > end result could end up being horrible spaghetti code of dependencies
> > and interrelated configs.
>
> That can be addressed as the need arises. A basic tenet of kernel
> development is to avoid speculative infrastructure.

True, but while this change simplifies the code a bit, the semantics
seem more muddled - devcg will be enforcing when CONFIG_CGROUP_DEV=y
and:

SECURITY=n or
rootplug is enabled
capabilities is enabled
smack is enabled
selinux+capabilities is enabled

It will not be enforcing when
dummy is loaded
only selinux (and not capabilities) is loaded

If that's ok with people then I'm fine with it. I suppose it should be
explained in the CONFIG_CGROUP_DEV help section, which it isn't in this
version I'm about to set. Patch hitting the wire in a minute.

thanks,
-serge

> > But OTOH we went years with no such changes, so that's probably not a
> > particularly practical concern unless someone can cite specific upcoming
> > examples. So if noone objects I'll try that approach.
>
> --
> James Morris
> <jmorris@namei.org>


\
 
 \ /
  Last update: 2008-03-13 15:41    [W:0.087 / U:1.576 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site