lkml.org 
[lkml]   [2008]   [Mar]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RFC] cgroups: implement device whitelist lsm (v2)
On Thu, 13 Mar 2008, Serge E. Hallyn wrote:

> True, but while this change simplifies the code a bit, the semantics
> seem more muddled - devcg will be enforcing when CONFIG_CGROUP_DEV=y
> and:
>
> SECURITY=n or
> rootplug is enabled
> capabilities is enabled
> smack is enabled
> selinux+capabilities is enabled

Well, this is how real systems are going to be deployed.

It becomes confusing, IMHO, if you have to change which secondary LSM you
stack with SELinux to enable a cgroup feature.

--
James Morris
<jmorris@namei.org>


\
 
 \ /
  Last update: 2008-03-13 23:31    [W:0.089 / U:1.928 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site