Based on kernel version 2.6.27. Page generated on 2008-10-13 09:53 EST.
1 Device Whitelist Controller 2 3 1. Description: 4 5 Implement a cgroup to track and enforce open and mknod restrictions 6 on device files. A device cgroup associates a device access 7 whitelist with each cgroup. A whitelist entry has 4 fields. 8 'type' is a (all), c (char), or b (block). 'all' means it applies 9 to all types and all major and minor numbers. Major and minor are 10 either an integer or * for all. Access is a composition of r 11 (read), w (write), and m (mknod). 12 13 The root device cgroup starts with rwm to 'all'. A child device 14 cgroup gets a copy of the parent. Administrators can then remove 15 devices from the whitelist or add new entries. A child cgroup can 16 never receive a device access which is denied by its parent. However 17 when a device access is removed from a parent it will not also be 18 removed from the child(ren). 19 20 2. User Interface 21 22 An entry is added using devices.allow, and removed using 23 devices.deny. For instance 24 25 echo 'c 1:3 mr' > /cgroups/1/devices.allow 26 27 allows cgroup 1 to read and mknod the device usually known as 28 /dev/null. Doing 29 30 echo a > /cgroups/1/devices.deny 31 32 will remove the default 'a *:* rwm' entry. Doing 33 34 echo a > /cgroups/1/devices.allow 35 36 will add the 'a *:* rwm' entry to the whitelist. 37 38 3. Security 39 40 Any task can move itself between cgroups. This clearly won't 41 suffice, but we can decide the best way to adequately restrict 42 movement as people get some experience with this. We may just want 43 to require CAP_SYS_ADMIN, which at least is a separate bit from 44 CAP_MKNOD. We may want to just refuse moving to a cgroup which 45 isn't a descendent of the current one. Or we may want to use 46 CAP_MAC_ADMIN, since we really are trying to lock down root. 47 48 CAP_SYS_ADMIN is needed to modify the whitelist or move another 49 task to a new cgroup. (Again we'll probably want to change that). 50 51 A cgroup may not be granted more permissions than the cgroup's 52 parent has.