[OFFLIST] status of devcg

[Tejun Heo]

On Thu, Jul 11, 2013 at 10:34:05AM +0100, Daniel P. Berrange wrote:
> FWIW, libvirt's usage of devcg is to deny all by default, allow major 136
> (for all /dev/pts/*), followed by allow (major,minor) pair for each specific
> whitelisted devices. As such we don't have anything that relies on ordering
> of rules in devcg.

I'd personally much prefer something very simple - allow all by
default, allow only the specified if explicitly specified.  I really
don't want full iptables like facility inside devcg.

Thanks.

-- 
tejun