lkml.org 
[lkml]   [2008]   [Mar]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RFC] cgroups: implement device whitelist lsm (v2)
Serge E. Hallyn wrote:
> Quoting James Morris (jmorris@namei.org):
>> On Thu, 13 Mar 2008, Serge E. Hallyn wrote:
>>
>>> Quoting James Morris (jmorris@namei.org):
>>>> On Thu, 13 Mar 2008, Serge E. Hallyn wrote:
>>>>
>>>>> True, but while this change simplifies the code a bit, the semantics
>>>>> seem more muddled - devcg will be enforcing when CONFIG_CGROUP_DEV=y
>>>>> and:
>>>>>
>>>>> SECURITY=n or
>>>>> rootplug is enabled
>>>>> capabilities is enabled
>>>>> smack is enabled
>>>>> selinux+capabilities is enabled
>>>> Well, this is how real systems are going to be deployed.
>>> Sorry, do you mean with capabilities?
>> Yes.
>>
>> All Fedora, RHEL, CentOS etc. ship with SELinux+capabilities. I can't
>> imagine not enabling them on other kernels.
>>
>>>> It becomes confusing, IMHO, if you have to change which secondary LSM you
>>>> stack with SELinux to enable a cgroup feature.
>>> So you're saying selinux without capabilities should still be able to
>>> use dev_cgroup? (Just making sure I understand right)
>> Nope, SELinux always stacks with capabilities, so havng the cgroup hooks
>> in capabilities makes sense (rather than having us change the secondary
>> stacking LSM just to enable a feature).
>
> Oh, ok.
>
> Will let the patch stand until Pavel and Greg comment then.

Well, I saw your previous patch, that was implemented as just another
LSM module and I liked it except for the LSM dependency.

Since this version can happily work w/o LSM, I like it too :)

> thanks,
> -serge
>



\
 
 \ /
  Last update: 2008-03-14 10:35    [W:0.062 / U:2.816 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site