Re: [libvirt] LXC: making the private root filesystem more secure

DB> mkdir /dev/cgroups/libvirt/lxc/{NAME} I have a small (and not-yet-working) patch that uses libcgroup[1] to setup a cgroup per container. This provides the ability to enforce the <memory> quantity on the group through memory.limit_in_bytes. I've also got some stubs that I plan to use to provide access to cpu.shares through the scheduling parameters interface. DB> echo "a" > /dev/cgroups/libvirt/lxc/{NAME}/devices.deny DB> echo "c 1:3 rwm" > /dev/cgroups/libvirt/lxc/{NAME}/devices.allow DB> echo "c 1:5 rwm" > /dev/cgroups/libvirt/lxc/{NAME}/devices.allow DB> echo "c 1:7 rwm" > /dev/cgroups/libvirt/lxc/{NAME}/devices.allow DB> echo "c 5:1 rwm" > /dev/cgroups/libvirt/lxc/{NAME}/devices.allow DB> echo "c 1:8 rwm" > /dev/cgroups/libvirt/lxc/{NAME}/devices.allow DB> echo "c 1:9 rwm" > /dev/cgroups/libvirt/lxc/{NAME}/devices.allow Adding this functionality to what I have should be rather trivial, I think. I'm still working with the libcgroup folks to get some kinks ironed out, but I will post the patches when we get something that works against some version of libcgroup. [1]: http://libcg.sourceforge.net -- Dan Smith IBM Linux Technology Center Open Hypervisor Team email: danms(a)us.ibm.com