cgroups.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 0/4] device_cgroup: replace internally whitelist with exception list
@ 2012-07-24 22:03 Aristeu Rozanski
  2012-07-24 22:03 ` [PATCH 1/4] device_cgroup: add "deny_all" in dev_cgroup structure Aristeu Rozanski
                   ` (4 more replies)
  0 siblings, 5 replies; 6+ messages in thread
From: Aristeu Rozanski @ 2012-07-24 22:03 UTC (permalink / raw)
  To: cgroups-u79uwXL29TY76Z2rM5mHXA
  Cc: Tejun Heo, Li Zefan, aris-H+wXaHxf7aLQT0dZR+AlfA

The original model of device_cgroup is having a whitelist where all the
allowed devices are listed. The problem with this approach is that is
impossible to have the case of allowing everything but few devices.

The reason for that lies in the way the whitelist is handled internally:
since there's only a whitelist, the "all devices" entry would have to be
removed and replaced by the entire list of possible devices but the ones
that are being denied.  Since dev_t is 32 bits long, representing the allowed
devices as a bitfield is not memory efficient.

This patch replaces the "whitelist" by a "exceptions" list and the default
policy is kept as "deny_all" variable in dev_cgroup structure.

The current interface determines that whenever "a" is written to devices.allow
or devices.deny, the entry masking all devices will be added or removed,
respectively. This behavior is kept and it's what will determine the default
policy:

	# cat devices.list 
	a *:* rwm
	# echo a >devices.deny
	# cat devices.list 
	# echo a >devices.allow
	# cat devices.list 
	a *:* rwm

The interface is also preserved. For example, if one wants to block only access
to /dev/null:
	# ls -l /dev/null
	crw-rw-rw- 1 root root 1, 3 Jul 24 16:17 /dev/null
	# echo a >devices.allow
	# echo "c 1:3 rwm" >devices.deny
	# cat /dev/null
	cat: /dev/null: Operation not permitted
	# echo >/dev/null
	bash: /dev/null: Operation not permitted
	mknod /tmp/null c 1 3
	mknod: ‘/tmp/null’: Operation not permitted
	# echo "c 1:3 r" >devices.allow
	# cat /dev/null
	# echo >/dev/null
	bash: /dev/null: Operation not permitted
	mknod /tmp/null c 1 3
	mknod: ‘/tmp/null’: Operation not permitted
	# echo "c 1:3 rw" >devices.allow
	# echo >/dev/null
	# cat /dev/null
	# mknod /tmp/null c 1 3
	mknod: ‘/tmp/null’: Operation not permitted
	# echo "c 1:3 rwm" >devices.allow
	# echo >/dev/null
	# cat /dev/null
	# mknod /tmp/null c 1 3
	#

 device_cgroup.c |  371 ++++++++++++++++++++++++++++++++------------------------
 1 file changed, 212 insertions(+), 159 deletions(-)

^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2012-07-30 14:51 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-07-24 22:03 [PATCH 0/4] device_cgroup: replace internally whitelist with exception list Aristeu Rozanski
2012-07-24 22:03 ` [PATCH 1/4] device_cgroup: add "deny_all" in dev_cgroup structure Aristeu Rozanski
2012-07-24 22:03 ` [PATCH 2/4] device_cgroup: introduce dev_whitelist_clean() Aristeu Rozanski
2012-07-24 22:03 ` [PATCH 3/4] device_cgroup: convert device_cgroup internally to policy + exceptions Aristeu Rozanski
2012-07-24 22:03 ` [PATCH 4/4] device_cgroup: rename whitelist to exception list Aristeu Rozanski
     [not found] ` <20120724220333.966415895-+5JutNtNrJPwzbzh4h2Q61C45dnP8DBc@public.gmane.org>
2012-07-30 14:51   ` [PATCH 0/4] device_cgroup: replace internally whitelist with " Aristeu Rozanski

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).