Re: [PATCH RESEND 0/4] device_cgroup: replace internally whitelist with exception list
On Thu, Aug 16, 2012 at 01:08:44PM -0700, Andrew Morton wrote: > On Thu, 09 Aug 2012 15:04:14 -0400 > a...@ruivo.org wrote: > > > The original model of device_cgroup is having a whitelist where all the > > allowed devices are listed. The problem with this approach is that is > > impossible to have the case of allowing everything but few devices. > > > > The reason for that lies in the way the whitelist is handled internally: > > since there's only a whitelist, the "all devices" entry would have to be > > removed and replaced by the entire list of possible devices but the ones > > that are being denied. Since dev_t is 32 bits long, representing the > > allowed > > devices as a bitfield is not memory efficient. > > > > This patch replaces the "whitelist" by a "exceptions" list and the default > > policy is kept as "deny_all" variable in dev_cgroup structure. > > The patches look reasonable to me. I suggest you resend them after > kernel summit and cc a few additional people: Serge Hallyn, Pavel > Emelyanov and James Morris. thanks, will do. will include the checkpatch fixes as well. -- Aristeu -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH RESEND 0/4] device_cgroup: replace internally whitelist with exception list
On Thu, 09 Aug 2012 15:04:14 -0400 a...@ruivo.org wrote: > The original model of device_cgroup is having a whitelist where all the > allowed devices are listed. The problem with this approach is that is > impossible to have the case of allowing everything but few devices. > > The reason for that lies in the way the whitelist is handled internally: > since there's only a whitelist, the "all devices" entry would have to be > removed and replaced by the entire list of possible devices but the ones > that are being denied. Since dev_t is 32 bits long, representing the allowed > devices as a bitfield is not memory efficient. > > This patch replaces the "whitelist" by a "exceptions" list and the default > policy is kept as "deny_all" variable in dev_cgroup structure. The patches look reasonable to me. I suggest you resend them after kernel summit and cc a few additional people: Serge Hallyn, Pavel Emelyanov and James Morris. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH RESEND 0/4] device_cgroup: replace internally whitelist with exception list
On Thu, 09 Aug 2012 15:04:14 -0400 a...@ruivo.org wrote: The original model of device_cgroup is having a whitelist where all the allowed devices are listed. The problem with this approach is that is impossible to have the case of allowing everything but few devices. The reason for that lies in the way the whitelist is handled internally: since there's only a whitelist, the all devices entry would have to be removed and replaced by the entire list of possible devices but the ones that are being denied. Since dev_t is 32 bits long, representing the allowed devices as a bitfield is not memory efficient. This patch replaces the whitelist by a exceptions list and the default policy is kept as deny_all variable in dev_cgroup structure. The patches look reasonable to me. I suggest you resend them after kernel summit and cc a few additional people: Serge Hallyn, Pavel Emelyanov and James Morris. -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Re: [PATCH RESEND 0/4] device_cgroup: replace internally whitelist with exception list
On Thu, Aug 16, 2012 at 01:08:44PM -0700, Andrew Morton wrote: On Thu, 09 Aug 2012 15:04:14 -0400 a...@ruivo.org wrote: The original model of device_cgroup is having a whitelist where all the allowed devices are listed. The problem with this approach is that is impossible to have the case of allowing everything but few devices. The reason for that lies in the way the whitelist is handled internally: since there's only a whitelist, the all devices entry would have to be removed and replaced by the entire list of possible devices but the ones that are being denied. Since dev_t is 32 bits long, representing the allowed devices as a bitfield is not memory efficient. This patch replaces the whitelist by a exceptions list and the default policy is kept as deny_all variable in dev_cgroup structure. The patches look reasonable to me. I suggest you resend them after kernel summit and cc a few additional people: Serge Hallyn, Pavel Emelyanov and James Morris. thanks, will do. will include the checkpatch fixes as well. -- Aristeu -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH RESEND 0/4] device_cgroup: replace internally whitelist with exception list
The original model of device_cgroup is having a whitelist where all the allowed devices are listed. The problem with this approach is that is impossible to have the case of allowing everything but few devices. The reason for that lies in the way the whitelist is handled internally: since there's only a whitelist, the "all devices" entry would have to be removed and replaced by the entire list of possible devices but the ones that are being denied. Since dev_t is 32 bits long, representing the allowed devices as a bitfield is not memory efficient. This patch replaces the "whitelist" by a "exceptions" list and the default policy is kept as "deny_all" variable in dev_cgroup structure. The current interface determines that whenever "a" is written to devices.allow or devices.deny, the entry masking all devices will be added or removed, respectively. This behavior is kept and it's what will determine the default policy: # cat devices.list a *:* rwm # echo a >devices.deny # cat devices.list # echo a >devices.allow # cat devices.list a *:* rwm The interface is also preserved. For example, if one wants to block only access to /dev/null: # ls -l /dev/null crw-rw-rw- 1 root root 1, 3 Jul 24 16:17 /dev/null # echo a >devices.allow # echo "c 1:3 rwm" >devices.deny # cat /dev/null cat: /dev/null: Operation not permitted # echo >/dev/null bash: /dev/null: Operation not permitted mknod /tmp/null c 1 3 mknod: â/tmp/nullâ: Operation not permitted # echo "c 1:3 r" >devices.allow # cat /dev/null # echo >/dev/null bash: /dev/null: Operation not permitted mknod /tmp/null c 1 3 mknod: â/tmp/nullâ: Operation not permitted # echo "c 1:3 rw" >devices.allow # echo >/dev/null # cat /dev/null # mknod /tmp/null c 1 3 mknod: â/tmp/nullâ: Operation not permitted # echo "c 1:3 rwm" >devices.allow # echo >/dev/null # cat /dev/null # mknod /tmp/null c 1 3 # device_cgroup.c | 371 1 file changed, 212 insertions(+), 159 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[PATCH RESEND 0/4] device_cgroup: replace internally whitelist with exception list
The original model of device_cgroup is having a whitelist where all the allowed devices are listed. The problem with this approach is that is impossible to have the case of allowing everything but few devices. The reason for that lies in the way the whitelist is handled internally: since there's only a whitelist, the all devices entry would have to be removed and replaced by the entire list of possible devices but the ones that are being denied. Since dev_t is 32 bits long, representing the allowed devices as a bitfield is not memory efficient. This patch replaces the whitelist by a exceptions list and the default policy is kept as deny_all variable in dev_cgroup structure. The current interface determines that whenever a is written to devices.allow or devices.deny, the entry masking all devices will be added or removed, respectively. This behavior is kept and it's what will determine the default policy: # cat devices.list a *:* rwm # echo a devices.deny # cat devices.list # echo a devices.allow # cat devices.list a *:* rwm The interface is also preserved. For example, if one wants to block only access to /dev/null: # ls -l /dev/null crw-rw-rw- 1 root root 1, 3 Jul 24 16:17 /dev/null # echo a devices.allow # echo c 1:3 rwm devices.deny # cat /dev/null cat: /dev/null: Operation not permitted # echo /dev/null bash: /dev/null: Operation not permitted mknod /tmp/null c 1 3 mknod: â/tmp/nullâ: Operation not permitted # echo c 1:3 r devices.allow # cat /dev/null # echo /dev/null bash: /dev/null: Operation not permitted mknod /tmp/null c 1 3 mknod: â/tmp/nullâ: Operation not permitted # echo c 1:3 rw devices.allow # echo /dev/null # cat /dev/null # mknod /tmp/null c 1 3 mknod: â/tmp/nullâ: Operation not permitted # echo c 1:3 rwm devices.allow # echo /dev/null # cat /dev/null # mknod /tmp/null c 1 3 # device_cgroup.c | 371 1 file changed, 212 insertions(+), 159 deletions(-) -- To unsubscribe from this list: send the line unsubscribe linux-kernel in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
