Re: [PATCH RESEND 0/4] device_cgroup: replace internally whitelist with exception list

On Thu, Aug 16, 2012 at 01:08:44PM -0700, Andrew Morton wrote:

On Thu, 09 Aug 2012 15:04:14 -0400
aris-moeOTchvdi7YtjvyW6yDsg@public.gmane.org wrote:

quoted

The original model of device_cgroup is having a whitelist where all the
allowed devices are listed. The problem with this approach is that is
impossible to have the case of allowing everything but few devices.

The reason for that lies in the way the whitelist is handled internally:
since there's only a whitelist, the "all devices" entry would have to be
removed and replaced by the entire list of possible devices but the ones
that are being denied.  Since dev_t is 32 bits long, representing the allowed
devices as a bitfield is not memory efficient.

This patch replaces the "whitelist" by a "exceptions" list and the default
policy is kept as "deny_all" variable in dev_cgroup structure.

The patches look reasonable to me.  I suggest you resend them after
kernel summit and cc a few additional people: Serge Hallyn, Pavel
Emelyanov and James Morris.

thanks, will do. will include the checkpatch fixes as well.

-- 
Aristeu