linux-kernel - Re: [RFC] How to handle the rules engine for cgroups

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080710104852.797fe79c@cuia.bos.redhat.com>
Date:	Thu, 10 Jul 2008 10:48:52 -0400
From:	Rik van Riel <riel@...hat.com>
To:	"Paul Menage" <menage@...gle.com>
Cc:	"Vivek Goyal" <vgoyal@...hat.com>,
	"KAMEZAWA Hiroyuki" <kamezawa.hiroyu@...fujitsu.com>,
	"linux kernel mailing list" <linux-kernel@...r.kernel.org>,
	"Libcg Devel Mailing List" <libcg-devel@...ts.sourceforge.net>,
	"Balbir Singh" <balbir@...ux.vnet.ibm.com>,
	"Dhaval Giani" <dhaval@...ux.vnet.ibm.com>,
	"Peter Zijlstra" <pzijlstr@...hat.com>,
	"Kazunaga Ikeno" <k-ikeno@...jp.nec.com>,
	"Morton Andrew Morton" <akpm@...ux-foundation.org>,
	"Thomas Graf" <tgraf@...hat.com>
Subject: Re: [RFC] How to handle the rules engine for cgroups

On Thu, 10 Jul 2008 02:23:52 -0700
"Paul Menage" <menage@...gle.com> wrote:

> I don't see the rule-based approach being all that useful for our needs.

Agreed, there really is no need for a rule-based approach in kernel space.

There are basically three different cases:

1) daemons get started up in their own process groups, this can
   be handled by the initscripts

2) user sessions (ssh, etc) start in their own process groups,
   this can be handled by PAM

3) users fork processes that should go into special process
   groups - this could be handled by having a small ruleset
   in userspace handle things, right before calling exec(),
   it can even be hidden from the application by hooking into
   the exec() call

If a user overrides the rules for their own processes, at worst
s/he takes away resources from him/herself.  No security problem.

Is there any reason at all to push for a kernel side rule-based
engine, except "I want to make my patch set unmergeable?"

-- 
All Rights Reversed
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/