questions about cgroup devices

questions about cgroup devices

[Ma Shimiao]

Hi all,

I think I met a problem about cgroup devices.

The following is my detailed operations:

# cd /sys/fs/cgroup/devices/
# mkdir test
# echo "c 1:3 rw" > test/devices.deny
# cat test/devices.list 
a *:* rwm

It seems my setting does not react in devices.list.

But in another terminal, /dev/null is really limited to access.
$ sudo cgexec -g devices:test dd if=/dev/zero of=/dev/null bs=1M count=128
dd: failed to open '/dev/null': Operation not permitted

So, is this a bug of cgroup devices?

Environment:
OS version: Fefora 25
Kernel version: 4.8.15-300.fc25.x86_64


Thanks
-- 
Ma Shimiao
Development Dept.I
Nanjing Fujitsu Nanda Software Tech. Co., Ltd.(FNST)

Re: questions about cgroup devices

[Zefan Li]

On 2017/1/23 15:16, Ma Shimiao wrote:
> Hi all,
> 
> I think I met a problem about cgroup devices.
> 
> The following is my detailed operations:
> 
> # cd /sys/fs/cgroup/devices/
> # mkdir test
> # echo "c 1:3 rw" > test/devices.deny
> # cat test/devices.list 
> a *:* rwm
> 
> It seems my setting does not react in devices.list.
> 
> But in another terminal, /dev/null is really limited to access.
> $ sudo cgexec -g devices:test dd if=/dev/zero of=/dev/null bs=1M count=128
> dd: failed to open '/dev/null': Operation not permitted
> 
> So, is this a bug of cgroup devices?
> 

It's not a bug. It's a feature introduced by commit ad676077a2ae4af4bb.
That said, I don't like this feature at all, because it's very confusing,
and obviously you are confused.

Re: questions about cgroup devices

[Ma Shimiao]

On 01/23/2017 03:35 PM, Zefan Li wrote:
> It's not a bug. It's a feature introduced by commit ad676077a2ae4af4bb.

Oh, got it.
> That said, I don't like this feature at all, because it's very confusing,
> and obviously you are confused.

Yes, I am really confused about this.

And, another problem is I can't allow/deny all devices.

# echo a > /sys/fs/cgroup/devices/test/devices.deny 
-bash: echo: write error: Invalid argument
# echo a > /sys/fs/cgroup/devices/test/devices.allow
-bash: echo: write error: Invalid argument

Is this also a new feature?


-- 
Ma Shimiao
Development Dept.I
Nanjing Fujitsu Nanda Software Tech. Co., Ltd.(FNST)

Re: questions about cgroup devices

[Ma Shimiao]

Hi Li,

On 01/23/2017 03:35 PM, Zefan Li wrote:
> It's not a bug. It's a feature introduced by commit ad676077a2ae4af4bb.
> That said, I don't like this feature at all, because it's very confusing,
> and obviously you are confused.

I have another question.
If devices.list does not react my settings,
how to easily find out I have made the right setting for cgroup devices?
For example, what has been allowed and what has been denied in cgroup devices.

Thanks,
-- 
Ma Shimiao
Development Dept.I
Nanjing Fujitsu Nanda Software Tech. Co., Ltd.(FNST)