Re: [RFC] cgroups: implement device whitelist lsm (v2)

[Casey Schaufler]

--- James Morris <jmorris@xxxxxxxxx> wrote:

> On Thu, 13 Mar 2008, Serge E. Hallyn wrote:
> 
> > Quoting James Morris (jmorris@xxxxxxxxx):
> > > On Thu, 13 Mar 2008, Serge E. Hallyn wrote:
> > > 
> > > > True, but while this change simplifies the code a bit, the semantics
> > > > seem more muddled - devcg will be enforcing when CONFIG_CGROUP_DEV=y
> > > > and:
> > > > 
> > > > 	SECURITY=n or
> > > > 	rootplug is enabled
> > > > 	capabilities is enabled
> > > > 	smack is enabled
> > > > 	selinux+capabilities is enabled
> > > 
> > > Well, this is how real systems are going to be deployed.
> > 
> > Sorry, do you mean with capabilities?
> 
> Yes.
> 
> All Fedora, RHEL, CentOS etc. ship with SELinux+capabilities.  I can't 
> imagine not enabling them on other kernels.
> 
> > > It becomes confusing, IMHO, if you have to change which secondary LSM you
> 
> > > stack with SELinux to enable a cgroup feature.
> > 
> > So you're saying selinux without capabilities should still be able to
> > use dev_cgroup?  (Just making sure I understand right)
> 
> Nope, SELinux always stacks with capabilities, so havng the cgroup hooks 
> in capabilities makes sense (rather than having us change the secondary 
> stacking LSM just to enable a feature).

That's what I was getting at. When the next feature comes along
are we going to stuff it into capabilities, too? Maybe we'll
cram it into audit or CIPSO instead, but how long can this go on?
Eventually we need a mechanism that allows more or less general
mix-and-match, maybe with a few rules like "don't mix plaids and
stripes" to keep things sane or these lesser facilities have no
chance. Seems like we're still making LSM too hard to use.

Unless I take an aggressive approach to adding them to Smack.
Hmm, might be a way to make a buck or two that way.
(Only kidding)(Well, mostly only kidding)

And yes, I understand that there are still those about who
don't like LSM in any form, much less in a useful one.


Casey Schaufler
casey@xxxxxxxxxxxxxxxx
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/