[linux-lvm] disabling udev_sync and udev_rules

[Zdenek Kabelac]

Dne 16.3.2016 v 17:17 Serguei Bezverkhi (sbezverk) napsal(a):
> Hi John,
>
> At least in our situation, Dockers do not own LV and nothing prevents in theory LV created by a process in one container, to be removed by another process in another container. It is exactly the same if two processed are trying to do the same thing.  In both cases if a volume is busy no process will be able to remove it.
>
> In our case, dockers are more like process wrapper, it does not holds any resources other than it needs to run this one process.
>
> I hope it clarifies a bit the approach we took.
>

Giving docker container root privileges to execute lvm2 command (or in effect 
any other root commands!) is just not the docker is supposed to be used (IMHO).

You are just making the security hole bigger and bigger...

But I assume there is no way to convince you it's serious mistake with this 
approach...

Regards

Zdenek


>
> -----Original Message-----
> From: linux-lvm-bounces at redhat.com [mailto:linux-lvm-bounces at redhat.com] On Behalf Of John Stoffel
> Sent: Wednesday, March 16, 2016 11:43 AM
> To: LVM general discussion and development <linux-lvm at redhat.com>
> Subject: Re: [linux-lvm] disabling udev_sync and udev_rules
>
>
> So what's to keep a docker container from deleting all your other LVs that it shouldn't know about?
>
> If I have a VG called coontainers, with a bunch of LVs called c1, c2, ... , cN.
>
> What is to keep c1 from nuking the LV in c2?
>
> John
>
> _______________________________________________
> linux-lvm mailing list
> linux-lvm at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-lvm
> read the LVM HOW-TO at http://tldp.org/HOWTO/LVM-HOWTO/
>
> _______________________________________________
> linux-lvm mailing list
> linux-lvm at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-lvm
> read the LVM HOW-TO at http://tldp.org/HOWTO/LVM-HOWTO/
>