Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1392341

Re: [PATCH v3 1/2] cgroup: apply common ancestor cgroup.procs restriction in cgroupv1

Show all headers | View raw

On Tue, May 03, 2016 at 12:01:20AM +1000, Aleksa Sarai wrote:
> The common ancestor restriction for moving tasks between cgroups (the
> process moving the task must have the right to write to cgroup.procs in
> both the destination and common ancestor cgroup) only applied for
> cgroupv2 (cgroups in the default hierarchy). This meant that there was a
> different policy for unprivileged users in the different cgroup
> hierarchies.
> 
> Update cgroup_procs_write_permission() to apply the cgroup.procs
> restriction regardless of the cgroup root of the destination cgroup.
> However, if the task doesn't have any association with the destination
> hierarchy, there's no permission check to be done. In addition, if the
> destination cgroup is a descendant of the task's current cgroup then
> there are no further permission checks. This is important for
> unprivileged processes creating subtrees.

So, you can't apply a new restriction like this retro-actively to
cgroup v1 hierarchies.

Thanks.

-- 
tejun

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v3 0/2] cgroup: allow management of subtrees by new cgroup namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-02 16:10 +0200
  [PATCH v3 2/2] cgroup: allow management of subtrees by new cgroup namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-02 16:10 +0200
    Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new  cgroup namespaces Tejun Heo <tj@kernel.org> - 2016-05-02 18:10 +0200
      Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new cgroup  namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-03 04:00 +0200
        Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new  cgroup namespaces Tejun Heo <tj@kernel.org> - 2016-05-03 18:00 +0200
          Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new cgroup  namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-04 12:00 +0200
            Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new cgroup  namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-09 16:10 +0200
  [PATCH v3 1/2] cgroup: apply common ancestor cgroup.procs restriction in cgroupv1 Aleksa Sarai <asarai@suse.de> - 2016-05-02 16:10 +0200
    Re: [PATCH v3 1/2] cgroup: apply common ancestor cgroup.procs  restriction in cgroupv1 Tejun Heo <tj@kernel.org> - 2016-05-02 18:10 +0200
      Re: [PATCH v3 1/2] cgroup: apply common ancestor cgroup.procs  restriction in cgroupv1 Aleksa Sarai <asarai@suse.de> - 2016-05-03 03:50 +0200

csiph-web