| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748 |
- Device Whitelist Controller
- 1. Description:
- Implement a cgroup to track and enforce open and mknod restrictions
- on device files. A device cgroup associates a device access
- whitelist with each cgroup. A whitelist entry has 4 fields.
- 'type' is a (all), c (char), or b (block). 'all' means it applies
- to all types and all major and minor numbers. Major and minor are
- either an integer or * for all. Access is a composition of r
- (read), w (write), and m (mknod).
- The root device cgroup starts with rwm to 'all'. A child device
- cgroup gets a copy of the parent. Administrators can then remove
- devices from the whitelist or add new entries. A child cgroup can
- never receive a device access which is denied its parent. However
- when a device access is removed from a parent it will not also be
- removed from the child(ren).
- 2. User Interface
- An entry is added using devices.allow, and removed using
- devices.deny. For instance
- echo 'c 1:3 mr' > /cgroups/1/devices.allow
- allows cgroup 1 to read and mknod the device usually known as
- /dev/null. Doing
- echo a > /cgroups/1/devices.deny
- will remove the default 'a *:* mrw' entry.
- 3. Security
- Any task can move itself between cgroups. This clearly won't
- suffice, but we can decide the best way to adequately restrict
- movement as people get some experience with this. We may just want
- to require CAP_SYS_ADMIN, which at least is a separate bit from
- CAP_MKNOD. We may want to just refuse moving to a cgroup which
- isn't a descendent of the current one. Or we may want to use
- CAP_MAC_ADMIN, since we really are trying to lock down root.
- CAP_SYS_ADMIN is needed to modify the whitelist or move another
- task to a new cgroup. (Again we'll probably want to change that).
- A cgroup may not be granted more permissions than the cgroup's
- parent has.
|
