Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757370AbYCNOmW (ORCPT ); Fri, 14 Mar 2008 10:42:22 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1753418AbYCNOmN (ORCPT ); Fri, 14 Mar 2008 10:42:13 -0400 Received: from e3.ny.us.ibm.com ([32.97.182.143]:44267 "EHLO e3.ny.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753154AbYCNOmM (ORCPT ); Fri, 14 Mar 2008 10:42:12 -0400 Date: Fri, 14 Mar 2008 09:42:09 -0500 From: "Serge E. Hallyn" To: Paul Menage Cc: "Serge E. Hallyn" , Pavel Emelyanov , James Morris , lkml , linux-security-module@vger.kernel.org, Greg KH , Stephen Smalley , Casey Schaufler Subject: Re: [RFC] cgroups: implement device whitelist lsm (v2) Message-ID: <20080314144209.GF9741@sergelap.austin.ibm.com> References: <20080313131818.GA9771@sergelap.austin.ibm.com> <20080313143803.GA11265@sergelap.austin.ibm.com> <20080313224616.GA9139@sergelap.austin.ibm.com> <20080314014121.GA8320@sergelap.austin.ibm.com> <47DA4533.8030106@openvz.org> <20080314135817.GE8744@sergelap.austin.ibm.com> <6599ad830803140712i1f9dede3yb0be99528934d974@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6599ad830803140712i1f9dede3yb0be99528934d974@mail.gmail.com> User-Agent: Mutt/1.5.16 (2007-06-09) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1065 Lines: 25 Quoting Paul Menage (menage@google.com): > On Fri, Mar 14, 2008 at 6:58 AM, Serge E. Hallyn wrote: > > James and Stephen agree with your LSM qualms. I suppose we could add > > cgroups next to the lsm hooks. I suspect Paul Menage would complain > > about that (Paul?), > > Depends on what you mean by "add cgroups to the LSM hooks". Could you > expand on that? cgroup hooks next to the lsm hooks. So in fs/namei.c where there are security_inode_permission() hooks, there would also be cgroup_inode_permission() hooks to let the devices cgroup mediate the access. Well, in permission(), probably not in exec_permission_lite() since that's probalby not a device access :) So far it looks like everyone likes that, so as long as you don't nack I guess that'll be the way to go. thanks, -serge -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/