Devices accessibility control group (v4)

Pavel Emelyanov lkml 1 version Mar 5, 2008 In review

Get series with b4

b4 am [email protected]

Versions newest first

v1 Latest Mar 5, 20089 patches 39 repliesIn review

Changes from v3 from the cover letter

* Ported on 2.6.25-rc3-mm1;
* Re-splitted into smaller pieces;
* Added more comments to tricky places.

Patches in v1 No applies recorded yet

#	Subject and files	Size	Replies
1/9	Avoid magic constants in drivers/base/map.c`drivers/base/map.c`	+12 -9	0 replies
2/9	Cleanup the get_gendisk() a bit`block/genhd.c`	+8 -3	0 replies
3/9	Add a mode on the struct probe`drivers/base/map.c`	+26 -5	0 replies
4/9	Make kobj_lookup() return the mapping's permissions`block/genhd.c` `drivers/base/map.c` `fs/block_dev.c` +3 more	+15 -8	0 replies
5/9	Make use of permissions, returned by kobj_lookup`block/genhd.c` `fs/block_dev.c` `fs/char_dev.c` +1 more	+43 -3	31 replies
6/9	Extend the drivers/base/map.c functionality`drivers/base/map.c` `include/linux/kobj_map.h`	+90 -0	0 replies
7/9	Provide functions to manipulate char device mappings`fs/char_dev.c` `include/linux/cdev.h`	+70 -0	0 replies
8/9	Provide functions to manipulate block device mappings`block/genhd.c` `include/linux/genhd.h`	+75 -0	0 replies
9/9	Devices accessibility control group itself`Documentation/controllers/devices.txt` `fs/Makefile` `fs/devscontrol.c` +3 more	+410 -0	1 reply

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.

Read the v1 thread

Cover letter [PATCH 0/9] Devices accessibility control group (v4)

Changes from v3:
* Ported on 2.6.25-rc3-mm1;
* Re-splitted into smaller pieces;
* Added more comments to tricky places.

This controller allows to tune the devices accessibility by tasks, i.e. grant full access for /dev/null, /dev/zero etc, grant read-only access to IDE devices and completely hide SCSI disks.

Tasks still can call mknod to create device files, regardless of whether the particular device is visible or accessible, but they may not be able to open it later.

This one hides under CONFIG_CGROUP_DEVS option.

To play with it - run a standard procedure:

 # mount -t container none /cont/devs -o devices
 # mkdir /cont/devs/0
 # echo -n $$ > /cont/devs/0/tasks

and tune device permissions.

The only configuration file called devices.permissions accepts strings like '[cb] <major>:(<minor>|*) [r-][w-]' to provide read, write or read-write access to a particular device. Asterisk as the minor means "all devices with a given major".

This will be described in Documentation/controllers/devices.txt file in more details.

Here are some historical notes.

The third version was here:
http://openvz.org/pipermail/devel/2008-February/010832.html
Changes from v2:
* Fixed problems pointed out by Sukadev with permissions revoke. Now we have to perform kobject re-lookup on each char device open, just like for block ones, so I think this is OK.

The second version was here:
http://openvz.org/pipermail/devel/2008-January/010160.html
Changes from v1:
* Added the block devices support :) It turned out to be a bit simpler than the char one (or I missed something significant);
* Now we can enable/disable not just individual devices, but the whole major with all its minors (see the TODO list beyond as well);
* Added the ability to restrict the read/write permissions to devices, not just visible/invisible state.

The first version was here:
http://openvz.org/pipermail/devel/2007-September/007647.html

Thanks,
Pavel

Read the cover letter in its thread