← Documents Documentation/admin-guide/cgroup-v1/devices.rst GitHub 원문 ↗

Linux 6.18.37 · Administration / Cgroup v1

Device Whitelist Controller

Device cgroup whitelist 형식, capability, deny 전파와 allow 비전파 계층 규칙을 설명합니다.

Source pathDocumentation/admin-guide/cgroup-v1/devices.rst
Source versionLinux v6.18.37
TranslationDUJINLABS 전문 번역 + 해설

요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.

1. 요약·해설

원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.

Rules and interface

devices.rst:1-39

Device rule field와 allow/deny write를 설명합니다.

Security

devices.rst:40-56

Capability와 parent permission 상한을 정리합니다.

Hierarchy

devices.rst:57-132

Deny propagation, local exception 재검증과 내부 behavior를 다룹니다.

2. 영어 원문 전체

번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.

원문 전체 펼치기
1 ===========================
2 Device Whitelist Controller
3 ===========================
4
5 1. Description
6 ==============
7
8 Implement a cgroup to track and enforce open and mknod restrictions
9 on device files. A device cgroup associates a device access
10 whitelist with each cgroup. A whitelist entry has 4 fields.
11 'type' is a (all), c (char), or b (block). 'all' means it applies
12 to all types and all major and minor numbers. Major and minor are
13 either an integer or * for all. Access is a composition of r
14 (read), w (write), and m (mknod).
15
16 The root device cgroup starts with rwm to 'all'. A child device
17 cgroup gets a copy of the parent. Administrators can then remove
18 devices from the whitelist or add new entries. A child cgroup can
19 never receive a device access which is denied by its parent.
20
21 2. User Interface
22 =================
23
24 An entry is added using devices.allow, and removed using
25 devices.deny. For instance::
26
27 echo 'c 1:3 mr' > /sys/fs/cgroup/1/devices.allow
28
29 allows cgroup 1 to read and mknod the device usually known as
30 /dev/null. Doing::
31
32 echo a > /sys/fs/cgroup/1/devices.deny
33
34 will remove the default 'a *:* rwm' entry. Doing::
35
36 echo a > /sys/fs/cgroup/1/devices.allow
37
38 will add the 'a *:* rwm' entry to the whitelist.
39
40 3. Security
41 ===========
42
43 Any task can move itself between cgroups. This clearly won't
44 suffice, but we can decide the best way to adequately restrict
45 movement as people get some experience with this. We may just want
46 to require CAP_SYS_ADMIN, which at least is a separate bit from
47 CAP_MKNOD. We may want to just refuse moving to a cgroup which
48 isn't a descendant of the current one. Or we may want to use
49 CAP_MAC_ADMIN, since we really are trying to lock down root.
50
51 CAP_SYS_ADMIN is needed to modify the whitelist or move another
52 task to a new cgroup. (Again we'll probably want to change that).
53
54 A cgroup may not be granted more permissions than the cgroup's
55 parent has.
56
57 4. Hierarchy
58 ============
59
60 device cgroups maintain hierarchy by making sure a cgroup never has more
61 access permissions than its parent. Every time an entry is written to
62 a cgroup's devices.deny file, all its children will have that entry removed
63 from their whitelist and all the locally set whitelist entries will be
64 re-evaluated. In case one of the locally set whitelist entries would provide
65 more access than the cgroup's parent, it'll be removed from the whitelist.
66
67 Example::
68
69 A
70 / \
71 B
72
73 group behavior exceptions
74 A allow "b 8:* rwm", "c 116:1 rw"
75 B deny "c 1:3 rwm", "c 116:2 rwm", "b 3:* rwm"
76
77 If a device is denied in group A::
78
79 # echo "c 116:* r" > A/devices.deny
80
81 it'll propagate down and after revalidating B's entries, the whitelist entry
82 "c 116:2 rwm" will be removed::
83
84 group whitelist entries denied devices
85 A all "b 8:* rwm", "c 116:* rw"
86 B "c 1:3 rwm", "b 3:* rwm" all the rest
87
88 In case parent's exceptions change and local exceptions are not allowed
89 anymore, they'll be deleted.
90
91 Notice that new whitelist entries will not be propagated::
92
93 A
94 / \
95 B
96
97 group whitelist entries denied devices
98 A "c 1:3 rwm", "c 1:5 r" all the rest
99 B "c 1:3 rwm", "c 1:5 r" all the rest
100
101 when adding ``c *:3 rwm``::
102
103 # echo "c *:3 rwm" >A/devices.allow
104
105 the result::
106
107 group whitelist entries denied devices
108 A "c *:3 rwm", "c 1:5 r" all the rest
109 B "c 1:3 rwm", "c 1:5 r" all the rest
110
111 but now it'll be possible to add new entries to B::
112
113 # echo "c 2:3 rwm" >B/devices.allow
114 # echo "c 50:3 r" >B/devices.allow
115
116 or even::
117
118 # echo "c *:3 rwm" >B/devices.allow
119
120 Allowing or denying all by writing 'a' to devices.allow or devices.deny will
121 not be possible once the device cgroups has children.
122
123 4.1 Hierarchy (internal implementation)
124 ---------------------------------------
125
126 device cgroups is implemented internally using a behavior (ALLOW, DENY) and a
127 list of exceptions. The internal state is controlled using the same user
128 interface to preserve compatibility with the previous whitelist-only
129 implementation. Removal or addition of exceptions that will reduce the access
130 to devices will be propagated down the hierarchy.
131 For every propagated exception, the effective rules will be re-evaluated based
132 on current parent's access rules.
133

3. 한국어 전문 번역

영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.

Device whitelist model

1-20

Device Whitelist Controller는 device file의 `open`과 `mknod` 제한을 추적하고 강제하는 cgroup controller입니다. 각 device cgroup에는 access whitelist가 연결됩니다.

Device-rule fields
FieldValuesMeaning
typea, c, ball, character, block device
majorinteger or *Device major number or wildcard
minorinteger or *Device minor number or wildcard
accessr, w, m compositionread, write, mknod

Whitelist entry를 구성하는 네 field입니다.

`a`는 모든 type과 모든 major·minor에 적용됩니다. Root device cgroup은 기본적으로 `a *:* rwm`, 즉 모든 device에 read/write/mknod 권한을 가집니다.

Whitelist inheritance
Root: a *:* rwmCreate childCopy parent effective accessAdministrator removes or adds entriesReject any access denied by parent

Child는 parent whitelist 사본에서 시작하지만 parent보다 넓은 권한을 가질 수 없습니다.

devices.allow와 devices.deny

21-39

`devices.allow`에 entry를 쓰면 허용 규칙을 추가하고 `devices.deny`에 쓰면 제거합니다. 다음 명령은 cgroup 1이 일반적으로 `/dev/null`인 character device `1:3`을 read하고 `mknod`하도록 허용합니다.

devices.deny.  For instance::

	echo 'c 1:3 mr' > /sys/fs/cgroup/1/devices.allow

allows cgroup 1 to read and mknod the device usually known as
/dev/null.  Doing::

	echo a > /sys/fs/cgroup/1/devices.deny

will remove the default 'a *:* rwm' entry. Doing::

	echo a > /sys/fs/cgroup/1/devices.allow
Device-controller writes
WriteEffect
echo 'c 1:3 mr' > devices.allowCharacter 1:3에 mknod와 read 허용
echo a > devices.denyDefault a *:* rwm 제거
echo a > devices.allowa *:* rwm 전체 허용 entry 추가

예제 write가 effective whitelist에 미치는 영향입니다.

Task 이동과 capability

40-56

문서 작성 당시 task가 스스로 cgroup 사이를 이동할 수 있다는 점은 충분한 보안 경계가 아니었습니다. 이동을 `CAP_SYS_ADMIN`으로 제한하거나 current cgroup의 descendant로만 허용하거나, root confinement 성격에 맞춰 `CAP_MAC_ADMIN`을 쓰는 방안이 논의됩니다.

Device-cgroup security rules
Operation or proposalRequirement or rule
Modify whitelistCAP_SYS_ADMIN
Move another taskCAP_SYS_ADMIN
Create device nodeCAP_MKNOD; separate from whitelist administration
Grant child accessNever exceed parent access
Possible future movement policyDescendant-only or CAP_MAC_ADMIN

현재 문서가 명시하는 권한과 변하지 않는 계층 제약입니다.

`CAP_SYS_ADMIN`은 whitelist 수정과 다른 task를 새 cgroup으로 이동하는 데 필요합니다. 어떤 경우에도 cgroup은 parent가 가진 것보다 더 많은 device permission을 부여받을 수 없습니다.

Deny 전파와 allow 비전파

57-122

Device cgroup hierarchy는 child가 parent보다 넓은 권한을 갖지 못하게 유지합니다. `devices.deny`에 entry가 쓰일 때마다 모든 descendant whitelist에서 그 access를 제거하고 locally set entry를 parent의 새 effective rule에 맞춰 다시 검증합니다.


      A
     / \
        B

    group        behavior	exceptions
    A            allow		"b 8:* rwm", "c 116:1 rw"
    B            deny		"c 1:3 rwm", "c 116:2 rwm", "b 3:* rwm"

If a device is denied in group A::

	# echo "c 116:* r" > A/devices.deny

it'll propagate down and after revalidating B's entries, the whitelist entry
"c 116:2 rwm" will be removed::

    group        whitelist entries                        denied devices
    A            all                                      "b 8:* rwm", "c 116:* rw"
    B            "c 1:3 rwm", "b 3:* rwm"                 all the rest
Deny propagation
Write c 116:* r to A/devices.denyReduce A effective accessPropagate restriction to BRe-evaluate B local exceptionsRemove c 116:2 rwm from B

A에서 `c 116:* r`을 deny하면 B의 충돌하는 local exception도 제거됩니다.

Effective result after parent deny
GroupWhitelist entriesDenied devices
Aall except local exceptionsb 8:* rwm, c 116:* rw
Bc 1:3 rwm, b 3:* rwmall the rest

원문 A/B 예제의 revalidation 결과입니다.

Parent exception이 변해 child의 local exception이 더 이상 허용되지 않으면 그 entry를 삭제합니다. 반대로 parent에 새 allow entry를 추가해도 기존 child whitelist에는 자동 전파하지 않습니다.


      A
     / \
        B

    group        whitelist entries                        denied devices
    A            "c 1:3 rwm", "c 1:5 r"                   all the rest
    B            "c 1:3 rwm", "c 1:5 r"                   all the rest

when adding ``c *:3 rwm``::

	# echo "c *:3 rwm" >A/devices.allow

the result::

    group        whitelist entries                        denied devices
    A            "c *:3 rwm", "c 1:5 r"                   all the rest
    B            "c 1:3 rwm", "c 1:5 r"                   all the rest

but now it'll be possible to add new entries to B::

	# echo "c 2:3 rwm" >B/devices.allow
	# echo "c 50:3 r" >B/devices.allow

or even::

	# echo "c *:3 rwm" >B/devices.allow
Allow is not propagated
A and B initially allow c 1:3 rwm and c 1:5 rAdd c *:3 rwm to AA expands effective accessB whitelist stays unchangedB may explicitly add c 2:3 rwm or c *:3 rwm

A의 권한 확장은 B의 현재 whitelist를 바꾸지 않지만 B가 같은 범위 안에서 새 entry를 추가할 수 있게 합니다.

Device cgroup에 child가 생긴 뒤에는 `devices.allow` 또는 `devices.deny`에 `a`를 써서 전체를 한 번에 allow/deny할 수 없습니다.

ALLOW·DENY behavior와 exception list

123-132

내부 구현은 `ALLOW` 또는 `DENY` behavior와 exception list를 사용합니다. 이전 whitelist-only interface와 compatibility를 유지하기 위해 같은 user interface로 내부 state를 제어합니다.

Internal hierarchy update
ChangePropagationValidation
Add/remove exception reducing accessDown the hierarchyAgainst current parent rules
Add permission to parentNot automatically propagatedChild opts in explicitly

Access를 줄이는 exception 변화만 descendant에 전파합니다.

전파된 각 exception마다 current parent access rule을 기준으로 descendant의 effective rule을 다시 계산합니다.