Messages in this thread |  | | Date | Fri, 14 Mar 2008 09:27:32 +1100 (EST) | From | James Morris <> | Subject | Re: [RFC] cgroups: implement device whitelist lsm (v2) |
| |
On Thu, 13 Mar 2008, Serge E. Hallyn wrote:
> True, but while this change simplifies the code a bit, the semantics > seem more muddled - devcg will be enforcing when CONFIG_CGROUP_DEV=y > and: > > SECURITY=n or > rootplug is enabled > capabilities is enabled > smack is enabled > selinux+capabilities is enabled
Well, this is how real systems are going to be deployed.
It becomes confusing, IMHO, if you have to change which secondary LSM you stack with SELinux to enable a cgroup feature.
-- James Morris <jmorris@namei.org>
|  |