Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

config-linux: Deprecate device access denial #1214

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

config-linux: Deprecate device access denial #1214

wants to merge 1 commit into from
+2 −1

Commits on Jul 17, 2023

  1. config-linux: Deprecate device access denial 

    Separate allow/deny lists are specific to device controller existing
only in cgroup v1. Current semantics for devices that don't match
neither allow nor deny is confusing.

cgroup v2 implements access control on the default hierarchy with BPF
hooks. Follow the approach of systemd (refer to systemd.resource(5))
with DevicePolicy=strict, i.e. consider all devices denied by default
and add only entries for devices that should be allowed.

This will simplify the job for runtimes that use systemd for container
cgroup configuration.

For starters, mention that "allow" entries that don't stick to the this
approach are deprecated. Next step would be removal of the "allow"
attribute and implicit denial on all devices.

Signed-off-by: Michal Koutný <[email protected]>
    @Werkov
    Werkov committed Jul 17, 2023
    Configuration menu
    Copy the full SHA
    bb837ae View commit details
    Browse the repository at this point in the history