Re: [PATCH] block: Add config option to not allow writing to mounted devices

Christoph Hellwig
2023-06-14T07:07:36Z

On Wed, Jun 14, 2023 at 09:05:41AM +0200, Christian Brauner wrote:
> > I kind of like the flexibility of device cgroups but it does not seem to
>
> Let's not bring in device cgroups here just yet. They're an optional LSM
> security measure while your change is more fundamental which is the
> right thing to do imho.

Yes. That last thing we need is hiding fundamentally security tradeoffs
in weird optional corners of the kernel.