Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

config-linux: Deprecate device access denial #1214

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

Werkov
Copy link

@Werkov Werkov commented Jul 12, 2023

Separate allow/deny lists are specific to device controller existing only in cgroup v1. Current semantics for devices that don't match neither allow nor deny is confusing.

cgroup v2 implements access control on the default hierarchy with BPF hooks. Follow the approach of systemd (refer to systemd.resource(5)) with DevicePolicy=strict, i.e. consider all devices denied by default and add only entries for devices that should be allowed.

This will simplify the job for runtimes that use systemd for container cgroup configuration.

For starters, mention that "allow" entries that don't stick to the this approach are deprecated. Next step would be removal of the "allow" attribute and implicit denial on all devices.

Separate allow/deny lists are specific to device controller existing
only in cgroup v1. Current semantics for devices that don't match
neither allow nor deny is confusing.

cgroup v2 implements access control on the default hierarchy with BPF
hooks. Follow the approach of systemd (refer to systemd.resource(5))
with DevicePolicy=strict, i.e. consider all devices denied by default
and add only entries for devices that should be allowed.

This will simplify the job for runtimes that use systemd for container
cgroup configuration.

For starters, mention that "allow" entries that don't stick to the this
approach are deprecated. Next step would be removal of the "allow"
attribute and implicit denial on all devices.

Signed-off-by: Michal Koutný <[email protected]>
@Werkov
Copy link
Author

Werkov commented Jan 5, 2024

Bump?

@utam0k
Copy link
Member

utam0k commented Jan 6, 2024

In cgroup v2, runc and other major OCI runtimes has implemented not only systemd but also its original cgroup v2 driver. How about this behavior? As far as I know, it attempts to emulate the cgroup v1's behavior.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants