Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1447947

Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for direct descendants

From Tejun Heo <tj@kernel.org>
Newsgroups linux.kernel
Subject Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for direct descendants
Date 2016-07-21 17:00 +0200
Message-ID <rXnCa-kD-35@gated-at.bofh.it> (permalink)
References (5 earlier) <rX8Wt-7Sc-1@gated-at.bofh.it> <rX8Wu-7Sc-3@gated-at.bofh.it> <rXgU1-4ur-19@gated-at.bofh.it> <rXniN-cH-9@gated-at.bofh.it> <rXnCa-kD-13@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

Hello, James.

On Thu, Jul 21, 2016 at 07:51:49AM -0700, James Bottomley wrote:
> What I haven't really heard yet in the debate is the policy reason why
> an unprivileged user shouldn't set up their own cgroups as children of
> the current ones (inheriting the constraints).

It's not even about policies.  The interface just can't support
operations like this in a robust way.  We can try to hack enough holes
at it to make some scenarios work but it's all but guaranteed that
such approach is gonna cause painful long-term issues.

> I have heard
> 
>  * it would give power to move other tasks to more rigid constraints. 
>     To which the answer is only to allow movememnt of tasks in the
>    current cgroupns
>  * It violates the permissions delegation model.  This one doesn't
>    really make too much sense to me: in the same way the userns is root
>    in its own domain, cgroups ns is effective root for the restricted
>    cgroups (and only for processes within its ns).
> 
> Perhaps the question should be asked the other way around:  if we were
> explicitly delegating permission to every user in the system to set up
> their own sub cgroups, how would you advise it be done?

Coordinate in userspace.  Request whatever is managing the cgroup
hierarchy to set up delegation.  It's not like permission model is
fully contained in kernel on modern systems anyway.

Thanks.

-- 
tejun

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v1 0/3] cgroup: allow for unprivileged management Aleksa Sarai <asarai@suse.de> - 2016-07-18 18:20 +0200
  [PATCH v1 3/3] cgroup: relax common ancestor restriction for direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-18 18:20 +0200
    Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-20 18:00 +0200
      Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-21 01:00 +0200
        Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 01:10 +0200
          Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-21 01:20 +0200
            Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 01:20 +0200
              Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-21 09:50 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-21 16:40 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 17:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants "Serge E. Hallyn" <serge@hallyn.com> - 2016-07-21 17:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants "Serge E. Hallyn" <serge@hallyn.com> - 2016-07-21 16:40 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-21 17:00 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 17:00 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-21 17:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 17:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 17:00 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-21 17:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 17:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-21 17:20 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 17:30 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-21 17:40 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 18:00 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-21 20:20 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 23:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-22 10:30 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-25 20:40 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-22 10:20 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-25 20:50 +0200

csiph-web