Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1392339

Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new cgroup namespaces

Show all headers | View raw

Hello,

On Tue, May 03, 2016 at 12:01:21AM +1000, Aleksa Sarai wrote:
> Allow an unprivileged processes to control subtrees of their associated
> cgroup, a necessary feature if an unprivileged container (set up with an
> unprivileged user namespace) wishes to take advantage of cgroups for its
> own subprocesses.
> 
> Change the mode of the cgroup directory for each cgroup association,
> allowing the process to create subtrees and modify the limits of the
> subtrees *without* allowing the process to modify its own limits. Due to
> the cgroup core restrictions and unix permission model, this allows for
> processes to create new subtrees without breaking the cgroup limits for
> the process.

I don't get why this is necessary.  What's wrong with the parent
setting up permission correctly for the namespace?

Thanks.

-- 
tejun

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v3 0/2] cgroup: allow management of subtrees by new cgroup namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-02 16:10 +0200
  [PATCH v3 2/2] cgroup: allow management of subtrees by new cgroup namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-02 16:10 +0200
    Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new  cgroup namespaces Tejun Heo <tj@kernel.org> - 2016-05-02 18:10 +0200
      Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new cgroup  namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-03 04:00 +0200
        Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new  cgroup namespaces Tejun Heo <tj@kernel.org> - 2016-05-03 18:00 +0200
          Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new cgroup  namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-04 12:00 +0200
            Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new cgroup  namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-09 16:10 +0200
  [PATCH v3 1/2] cgroup: apply common ancestor cgroup.procs restriction in cgroupv1 Aleksa Sarai <asarai@suse.de> - 2016-05-02 16:10 +0200
    Re: [PATCH v3 1/2] cgroup: apply common ancestor cgroup.procs  restriction in cgroupv1 Tejun Heo <tj@kernel.org> - 2016-05-02 18:10 +0200
      Re: [PATCH v3 1/2] cgroup: apply common ancestor cgroup.procs  restriction in cgroupv1 Aleksa Sarai <asarai@suse.de> - 2016-05-03 03:50 +0200

csiph-web