Re: [libvirt] LXC: making the private root filesystem more secure

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



DB>     mkdir /dev/cgroups/libvirt/lxc/{NAME}

I have a small (and not-yet-working) patch that uses libcgroup[1] to
setup a cgroup per container.  This provides the ability to enforce the
<memory> quantity on the group through memory.limit_in_bytes.  I've also
got some stubs that I plan to use to provide access to cpu.shares
through the scheduling parameters interface.

DB>     echo "a" > /dev/cgroups/libvirt/lxc/{NAME}/devices.deny
DB>     echo "c 1:3 rwm" > /dev/cgroups/libvirt/lxc/{NAME}/devices.allow
DB>     echo "c 1:5 rwm" > /dev/cgroups/libvirt/lxc/{NAME}/devices.allow
DB>     echo "c 1:7 rwm" > /dev/cgroups/libvirt/lxc/{NAME}/devices.allow
DB>     echo "c 5:1 rwm" > /dev/cgroups/libvirt/lxc/{NAME}/devices.allow
DB>     echo "c 1:8 rwm" > /dev/cgroups/libvirt/lxc/{NAME}/devices.allow
DB>     echo "c 1:9 rwm" > /dev/cgroups/libvirt/lxc/{NAME}/devices.allow

Adding this functionality to what I have should be rather trivial, I
think.

I'm still working with the libcgroup folks to get some kinks ironed out,
but I will post the patches when we get something that works against
some version of libcgroup.

[1]: http://libcg.sourceforge.net

-- 
Dan Smith
IBM Linux Technology Center
Open Hypervisor Team
email: danms@xxxxxxxxxx

Attachment: pgpiUb6w7534O.pgp
Description: PGP signature

--
Libvir-list mailing list
Libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list

[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]