Re: [TESTING] Device whitelist on cgroups

Re: [TESTING] Device whitelist on cgroups

[Serge E. Hallyn]

Quoting Subrata Modak (subrata-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org):
> Serge,
> 
> I have another doubt. Are we also having the plan(s) to add testcases
> for testing this new feature (Device whitelist on cgroups) added in
> 2.6.26 under the DEVICE NAMESPACE category !!
> 
> Regards--
> Subrata

That's something I expect Veerendra would do next year.  (Veerendra,
if you have time this year, please let me know).

It also seems likely that the openvz folks, who are using this,
have some testcases they could share.  Pavel?

-serge

Re: [TESTING] Device whitelist on cgroups

[Pavel Emelyanov]

Serge E. Hallyn wrote:
> Quoting Subrata Modak (subrata-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org):
>> Serge,
>>
>> I have another doubt. Are we also having the plan(s) to add testcases
>> for testing this new feature (Device whitelist on cgroups) added in
>> 2.6.26 under the DEVICE NAMESPACE category !!
>>
>> Regards--
>> Subrata
> 
> That's something I expect Veerendra would do next year.  (Veerendra,
> if you have time this year, please let me know).
> 
> It also seems likely that the openvz folks, who are using this,
> have some testcases they could share.  Pavel?

We have and we could share them, but unfortunately their 
*implementation* is completely useless without the whole 
testing infrastructure we use (which it turn is too heavy
and too Virtuozzo-specific to be shared).

All I can is provide a single testcase we perform: set some
permissions and check that the allowed devices are allowed
and not allowed are not allowed ;)

> -serge
> 

Re: [TESTING] Device whitelist on cgroups

[Serge E. Hallyn]

Quoting Pavel Emelyanov (xemul-GEFAQzZX7r8dnm+yROfE0A@public.gmane.org):
> Serge E. Hallyn wrote:
> > Quoting Subrata Modak (subrata-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org):
> >> Serge,
> >>
> >> I have another doubt. Are we also having the plan(s) to add testcases
> >> for testing this new feature (Device whitelist on cgroups) added in
> >> 2.6.26 under the DEVICE NAMESPACE category !!
> >>
> >> Regards--
> >> Subrata
> > 
> > That's something I expect Veerendra would do next year.  (Veerendra,
> > if you have time this year, please let me know).
> > 
> > It also seems likely that the openvz folks, who are using this,
> > have some testcases they could share.  Pavel?
> 
> We have and we could share them, but unfortunately their 
> *implementation* is completely useless without the whole 
> testing infrastructure we use (which it turn is too heavy
> and too Virtuozzo-specific to be shared).
> 
> All I can is provide a single testcase we perform: set some
> permissions and check that the allowed devices are allowed
> and not allowed are not allowed ;)

Ok, thanks, Pavel.  Sounds like starting from scratch would be
the simplest thing here.

-serge

Re: [TESTING] Device whitelist on cgroups

[Subrata Modak]

On Tue, 2008-08-26 at 11:00 -0500, Serge E. Hallyn wrote:
> Quoting Pavel Emelyanov (xemul@openvz.org):
> > Serge E. Hallyn wrote:
> > > Quoting Subrata Modak (subrata@linux.vnet.ibm.com):
> > >> Serge,
> > >>
> > >> I have another doubt. Are we also having the plan(s) to add testcases
> > >> for testing this new feature (Device whitelist on cgroups) added in
> > >> 2.6.26 under the DEVICE NAMESPACE category !!
> > >>
> > >> Regards--
> > >> Subrata
> > > 
> > > That's something I expect Veerendra would do next year.  (Veerendra,
> > > if you have time this year, please let me know).
> > > 
> > > It also seems likely that the openvz folks, who are using this,
> > > have some testcases they could share.  Pavel?
> > 
> > We have and we could share them, but unfortunately their 
> > *implementation* is completely useless without the whole 
> > testing infrastructure we use (which it turn is too heavy
> > and too Virtuozzo-specific to be shared).
> > 
> > All I can is provide a single testcase we perform: set some
> > permissions and check that the allowed devices are allowed
> > and not allowed are not allowed ;)
> 
> Ok, thanks, Pavel.  Sounds like starting from scratch would be
> the simplest thing here.

Pavel,

You can even share that single test case with us. This can help
Veerendra to get a direction when he starts writing for DEVICE Namespace
test cases either this year, or, next year. I feel it´s always better to
get a good start if we have some direction in our hands. Pavel, please
share the same.

Regards--
Subrata

> 
> -serge

_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containers