Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1447949

Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for direct descendants

From Aleksa Sarai <asarai@suse.de>
Newsgroups linux.kernel
Subject Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for direct descendants
Date 2016-07-21 17:10 +0200
Message-ID <rXnLP-DS-1@gated-at.bofh.it> (permalink)
References (6 earlier) <rX8Wu-7Sc-3@gated-at.bofh.it> <rXgU1-4ur-19@gated-at.bofh.it> <rXniN-cH-9@gated-at.bofh.it> <rXnCa-kD-13@gated-at.bofh.it> <rXnCa-kD-35@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

>> I have heard
>>
>>  * it would give power to move other tasks to more rigid constraints.
>>     To which the answer is only to allow movememnt of tasks in the
>>    current cgroupns
>>  * It violates the permissions delegation model.  This one doesn't
>>    really make too much sense to me: in the same way the userns is root
>>    in its own domain, cgroups ns is effective root for the restricted
>>    cgroups (and only for processes within its ns).
>>
>> Perhaps the question should be asked the other way around:  if we were
>> explicitly delegating permission to every user in the system to set up
>> their own sub cgroups, how would you advise it be done?
>
> Coordinate in userspace.  Request whatever is managing the cgroup
> hierarchy to set up delegation.  It's not like permission model is
> fully contained in kernel on modern systems anyway.

My experience with certain systemdaemons' cgroup handling doesn't 
inspire confidence :/ (from the runC side, we've had nothing but 
issues). Also, how do you even boot into a cgroupv2 system with systemd 
(I started backporting patches to openSUSE, but it's still not booting)?

-- 
Aleksa Sarai
Software Engineer (Containers)
SUSE Linux GmbH
https://www.cyphar.com/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v1 0/3] cgroup: allow for unprivileged management Aleksa Sarai <asarai@suse.de> - 2016-07-18 18:20 +0200
  [PATCH v1 3/3] cgroup: relax common ancestor restriction for direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-18 18:20 +0200
    Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-20 18:00 +0200
      Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-21 01:00 +0200
        Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 01:10 +0200
          Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-21 01:20 +0200
            Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 01:20 +0200
              Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-21 09:50 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-21 16:40 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 17:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants "Serge E. Hallyn" <serge@hallyn.com> - 2016-07-21 17:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants "Serge E. Hallyn" <serge@hallyn.com> - 2016-07-21 16:40 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-21 17:00 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 17:00 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-21 17:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 17:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 17:00 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-21 17:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 17:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-21 17:20 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 17:30 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-21 17:40 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 18:00 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-21 20:20 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 23:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-22 10:30 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-25 20:40 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-22 10:20 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-25 20:50 +0200

csiph-web