Re: [PATCH] capabilities: add capability cgroup controller

From	"Serge E. Hallyn" <serge@hallyn.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH] capabilities: add capability cgroup controller
Date	2016-06-27 17:00 +0200
Message-ID	<rOGaZ-1Du-21@gated-at.bofh.it> (permalink)
References	(5 earlier) <rNCj8-22X-7@gated-at.bofh.it> <rNCCt-2dO-21@gated-at.bofh.it> <rND5v-2Dp-3@gated-at.bofh.it> <rOnL3-6RG-7@gated-at.bofh.it> <rOqIW-co-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Quoting Tejun Heo (tj@kernel.org):
> Hello, Topi.
> 
> On Sun, Jun 26, 2016 at 3:14 PM, Topi Miettinen <toiwoton@gmail.com> wrote:
> > The parent might be able do it if proc/pid/xyz files are still
> > accessible after child exit but before its exit status is collected. But
> > if the parent doesn't do it (and you are not able to change it to do it)
> > and it collects the exit status without collecting other info, can you
> > suggest a different way how another process could collect it 100% reliably?
> 
> I'm not saying that there's such mechanism now. I'm suggesting that
> that'd be a more fitting way of implementing a new mechanism to track
> capability usages.

Hi Topi,

I think Eric was right a few emails earlier that the audit subsystem is
really the most appropriate answer to this.  (Perhaps sysctl-controllered?)
Combined with taskstats it would give you what you need.  Or you could even
use an empty new named cgroup controller, say 'none,name=caps', and then
look only at audit results for cgroup '/myapp' in the caps hierarchy.

Thread

Re: [PATCH] capabilities: add capability cgroup controller Tejun Heo <tj@kernel.org> - 2016-06-23 23:40 +0200
  Re: [PATCH] capabilities: add capability cgroup controller Topi Miettinen <toiwoton@gmail.com> - 2016-06-24 02:30 +0200
    Re: [PATCH] capabilities: add capability cgroup controller Tejun Heo <tj@kernel.org> - 2016-06-24 17:50 +0200
      Re: [PATCH] capabilities: add capability cgroup controller "Serge E. Hallyn" <serge@hallyn.com> - 2016-06-24 18:00 +0200
        Re: [PATCH] capabilities: add capability cgroup controller Tejun Heo <tj@kernel.org> - 2016-06-24 18:40 +0200
          Re: [PATCH] capabilities: add capability cgroup controller "Serge E. Hallyn" <serge@hallyn.com> - 2016-06-24 19:00 +0200
            Re: [PATCH] capabilities: add capability cgroup controller Tejun Heo <tj@kernel.org> - 2016-06-24 19:30 +0200
              Re: [PATCH] capabilities: add capability cgroup controller Topi Miettinen <toiwoton@gmail.com> - 2016-06-26 21:20 +0200
                Re: [PATCH] capabilities: add capability cgroup controller Tejun Heo <tj@kernel.org> - 2016-06-27 00:30 +0200
                Re: [PATCH] capabilities: add capability cgroup controller "Serge E. Hallyn" <serge@hallyn.com> - 2016-06-27 17:00 +0200
                Re: [PATCH] capabilities: add capability cgroup controller Tejun Heo <tj@kernel.org> - 2016-06-27 21:20 +0200
                Re: [PATCH] capabilities: add capability cgroup controller "Serge E. Hallyn" <serge@hallyn.com> - 2016-06-27 21:50 +0200
                Re: [PATCH] capabilities: add capability cgroup controller Topi Miettinen <toiwoton@gmail.com> - 2016-07-03 17:10 +0200
                Re: [PATCH] capabilities: audit capability use kbuild test robot <lkp@intel.com> - 2016-07-03 18:20 +0200
                Re: [PATCH] capabilities: add capability cgroup controller Petr Mladek <pmladek@suse.com> - 2016-07-07 11:20 +0200
                Re: [PATCH] capabilities: add capability cgroup controller Topi Miettinen <toiwoton@gmail.com> - 2016-07-07 22:30 +0200
                Re: [PATCH] capabilities: add capability cgroup controller Petr Mladek <pmladek@suse.com> - 2016-07-08 11:20 +0200
                Re: [PATCH] capabilities: add capability cgroup controller Topi Miettinen <toiwoton@gmail.com> - 2016-07-09 18:40 +0200
                Re: [PATCH] capabilities: add capability cgroup controller Topi Miettinen <toiwoton@gmail.com> - 2016-06-27 21:20 +0200
            Re: [PATCH] capabilities: add capability cgroup controller ebiederm@xmission.com (Eric W. Biederman) - 2016-06-24 19:40 +0200
              Re: [PATCH] capabilities: add capability cgroup controller "Serge E. Hallyn" <serge@hallyn.com> - 2016-06-24 19:50 +0200
              Re: [PATCH] capabilities: add capability cgroup controller Topi Miettinen <toiwoton@gmail.com> - 2016-06-26 21:10 +0200
                Re: [PATCH] capabilities: add capability cgroup controller ebiederm@xmission.com (Eric W. Biederman) - 2016-06-28 07:10 +0200
                Re: [PATCH] capabilities: add capability cgroup controller Topi Miettinen <toiwoton@gmail.com> - 2016-07-02 13:30 +0200

csiph-web