From mboxrd@z Thu Jan 1 00:00:00 1970 From: Serge Hallyn Subject: Re: [OFFLIST] status of devcg Date: Thu, 11 Jul 2013 11:05:32 -0500 Message-ID: <20130711160532.GA14909@ac100> References: <20130710184655.GB16979@mtj.dyndns.org> <20130710195001.GW14011@redhat.com> <20130711093405.GC2377@redhat.com> <20130711155106.GB9229@mtj.dyndns.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <20130711155106.GB9229-9pTldWuhBndy/B6EtB590w@public.gmane.org> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Tejun Heo Cc: Kay Sievers , containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, Lennart Poettering , cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Quoting Tejun Heo (tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org): > On Thu, Jul 11, 2013 at 10:34:05AM +0100, Daniel P. Berrange wrote: > > FWIW, libvirt's usage of devcg is to deny all by default, allow major 136 > > (for all /dev/pts/*), followed by allow (major,minor) pair for each specific > > whitelisted devices. As such we don't have anything that relies on ordering > > of rules in devcg. > > I'd personally much prefer something very simple - allow all by > default, allow only the specified if explicitly specified. I really > don't want full iptables like facility inside devcg. > > Thanks. FWIW lxc is also quite happy with the simple rules. Is there something in particular you want to accomplish for which the current rules do not suffice?