Re: cgroup: denying device doesn't work with 'rw' mode string

[Li Zefan <lizefan@huawei.com>]

Amos Kong wrote:

> CC: Li Zefan <lizf@cn.fujitsu.com>, Tejun Heo <tj@kernel.org>, jmorris@namei.org
> 
> On Sat, Oct 15, 2011 at 8:39 AM, Amos Kong <kongjianjun@gmail.com> wrote:
>> # mount -t cgroup -o devices none /cgroup
>> # mkdir /cgroups/devices
>> # ls -l /dev/vg/lv
>> lrwxrwxrwx. 1 root root 7 Oct 14 19:03 /dev/vg/lv -> ../dm-3
>> # ls -l /dev/dm-3
>> brw-rw----. 1 root disk 253, 3 Oct 14 19:03 /dev/dm-3
>>
>>
>> ------- test1
>> deny read-write permission of dm-3, but it doesn't effect.
>>
>> # echo a > devices/devices.allow
>> # echo 'b 253:2 rw' > devices.deny


253:2 ??

>>                ^^
>> # echo $$ > task
>> # dd if=/dev/zero of=/dev/dm-3 bs=1M count=1
>> can write to /dev/dm-3 successfully  (problem exists)
>>
>> ------- test2
>> # echo a > devices/devices.allow
>> # echo 'b 253:3 rwm' > devices/devices.deny


253:3 !!

>>                ^^^
>> # echo $$ > task
>> # dd if=/dev/zero of=/dev/dm-3 bs=1M count=1
>> couldn't write to /dev/dm-3 successfully