Re: [RFC] cgroups: implement device whitelist lsm (v2)

[Pavel Emelyanov <xemul@openvz.org>]

Serge E. Hallyn wrote:
> Quoting James Morris (jmorris@namei.org):
>> On Thu, 13 Mar 2008, Serge E. Hallyn wrote:
>>
>>> Quoting James Morris (jmorris@namei.org):
>>>> On Thu, 13 Mar 2008, Serge E. Hallyn wrote:
>>>>
>>>>> True, but while this change simplifies the code a bit, the semantics
>>>>> seem more muddled - devcg will be enforcing when CONFIG_CGROUP_DEV=y
>>>>> and:
>>>>>
>>>>> 	SECURITY=n or
>>>>> 	rootplug is enabled
>>>>> 	capabilities is enabled
>>>>> 	smack is enabled
>>>>> 	selinux+capabilities is enabled
>>>> Well, this is how real systems are going to be deployed.
>>> Sorry, do you mean with capabilities?
>> Yes.
>>
>> All Fedora, RHEL, CentOS etc. ship with SELinux+capabilities.  I can't 
>> imagine not enabling them on other kernels.
>>
>>>> It becomes confusing, IMHO, if you have to change which secondary LSM you 
>>>> stack with SELinux to enable a cgroup feature.
>>> So you're saying selinux without capabilities should still be able to
>>> use dev_cgroup?  (Just making sure I understand right)
>> Nope, SELinux always stacks with capabilities, so havng the cgroup hooks 
>> in capabilities makes sense (rather than having us change the secondary 
>> stacking LSM just to enable a feature).
> 
> Oh, ok.
> 
> Will let the patch stand until Pavel and Greg comment then.

Well, I saw your previous patch, that was implemented as just another
LSM module and I liked it except for the LSM dependency.

Since this version can happily work w/o LSM, I like it too :)

> thanks,
> -serge
>