Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1392090

Re: [PATCH v2] cgroup: allow management of subtrees by new cgroup namespaces

From Aleksa Sarai <asarai@suse.de>
Newsgroups linux.kernel
Subject Re: [PATCH v2] cgroup: allow management of subtrees by new cgroup namespaces
Date 2016-05-02 11:40 +0200
Message-ID <ruiuB-Vd-17@gated-at.bofh.it> (permalink)
References <rtZV0-1Se-7@gated-at.bofh.it> <rtZV0-1Se-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

> +	 * 3. cgroup core doesn't allow tasks to be migrated by users that have
> +	 *    write access to two subtrees unless they also have write access to
> +	 *    the common ancestor of the two subtrees. Thus you cannot use a
> +	 *    complicit process in less restrictive cgroup to overcome your own
> +	 *    cgroup restriction.

It appears this restriction isn't actually being applied on cgroupv1. 
I'll send an updated patch which makes sure the cgroup.proc common 
ancestor restriction is enforced for all hierarchies.

-- 
Aleksa Sarai
Software Engineer (Containers)
SUSE Linux GmbH
https://www.cyphar.com/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v2] cgroup: allow management of subtrees by new cgroup namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-01 15:50 +0200
  Re: [PATCH v2] cgroup: allow management of subtrees by new cgroup  namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-02 11:40 +0200
  Re: [PATCH v2] cgroup: allow management of subtrees by new cgroup  namespaces James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-05-03 00:10 +0200
    Re: [PATCH v2] cgroup: allow management of subtrees by new cgroup  namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-03 04:00 +0200
      Re: [PATCH v2] cgroup: allow management of subtrees by new cgroup  namespaces James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-05-03 04:30 +0200
        Re: [PATCH v2] cgroup: allow management of subtrees by new cgroup  namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-03 08:50 +0200
          Re: [PATCH v2] cgroup: allow management of subtrees by new cgroup  namespaces James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-05-03 16:30 +0200
            Re: [PATCH v2] cgroup: allow management of subtrees by new cgroup  namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-04 12:00 +0200

csiph-web