Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1404553

Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new cgroup namespaces

Show all headers | View raw

On Fri, 2016-05-20 at 08:22 -0700, Tejun Heo wrote:
> On Sat, May 21, 2016 at 12:48:48AM +1000, Aleksa Sarai wrote:
> > Are there any comments on this version of the patchset? I thought 
> > we had reached an agreement that the underlying feature (allowing a
> > process to manage its own cgroups) was useful. Is there a better 
> > way of solving this problem, that I don't know of?
> 
> I still don't see why this is necessary.  Delegation is done through
> chmodding.  There's no reason to deviate for namespaces.

Given it's merge window time, I haven't yet had time to look at the
patch, but I can tell you why it (or something like it) is necessary:
unprivileged containers need to be able to set up cgroups as well as
namespaces, so we do need a way for the user ns owner to modify cgroups
in their default configuration otherwise cgroups just won't fit into
the unprivileged model.  Whether this should be through the cgroup ns
is up for debate, as is how we should actually allow this to happen and
what we should present to the user ns owner, but we do need a way to do
this.

Delegation can't be through chmodding in this case because the user ns
owner can't chmod something owned by init_user_ns root.

James

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v4 0/2] cgroup: allow management of subtrees by new cgroup namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-14 05:30 +0200
  [PATCH v4 2/2] cgroup: implement subtree creation on copy_cgroup_ns() Aleksa Sarai <asarai@suse.de> - 2016-05-14 05:30 +0200
  Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new cgroup  namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-20 16:50 +0200
    Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces Tejun Heo <tj@kernel.org> - 2016-05-20 17:30 +0200
      Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-05-20 17:40 +0200
        Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces Tejun Heo <tj@kernel.org> - 2016-05-20 18:10 +0200
          Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-05-20 18:10 +0200
            Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces Tejun Heo <tj@kernel.org> - 2016-05-20 18:20 +0200
              Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-05-20 18:30 +0200
                Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new cgroup  namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-20 18:40 +0200
                Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces Tejun Heo <tj@kernel.org> - 2016-05-20 19:10 +0200
                Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-05-20 19:30 +0200
                Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces Tejun Heo <tj@kernel.org> - 2016-05-20 19:50 +0200
                Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new cgroup namespaces Aleksa Sarai <cyphar@cyphar.com> - 2016-05-28 07:20 +0200
                Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces "W. Trevor King" <wking@tremily.us> - 2016-05-20 19:50 +0200
                Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new cgroup namespaces Aditya Kali <adityakali@google.com> - 2016-05-20 19:40 +0200
                Re: [PATCH v4 0/2] cgroup: allow management of subtrees by new  cgroup namespaces James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-05-20 20:00 +0200

csiph-web