[lkml]   [2008]   [Mar]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [RFC] cgroups: implement device whitelist lsm (v2)
On Fri, Mar 14, 2008 at 7:05 AM, Serge E. Hallyn <> wrote:
> > > A task may only be moved to another devcgroup if it is moving to
> > > a direct descendent of its current devcgroup.
> >
> > What's the rationale for that?
> To prevent it escaping to laxer device permissions, which of course only
> makes sense if we do what you recommend above :)

That makes it impossible for a root process to enter a child cgroup,
do something, and then go back to its own cgroup. Why aren't the
existing cgroup security semantics sufficient?


 \ /
  Last update: 2008-03-14 15:19    [W:0.069 / U:3.580 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site