Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1537116

Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a process to migrate other tasks between cgroups

Show all headers | View raw

Hello,

On Mon, Dec 05, 2016 at 04:36:51PM -0800, Andy Lutomirski wrote:
> I really don't know.  The cgroupfs interface is a bit unfortunate in
> that it doesn't really express the constraints.  To safely migrate a
> task, ISTM you ought to have some form of privilege over the task
> *and* some form of privilege over the cgroup.  cgroupfs only handles
> the latter.
> 
> CAP_CGROUP_MIGRATE ought to be okay.  Or maybe cgroupfs needs to gain
> a concept of "dangerous" cgroups and further restrict them and
> CAP_SYS_RESOURCE should be fine for non-dangerous cgroups?  I think I
> favor the latter, but it might be nice to hear from Tejun first.

If we can't do CAP_SYS_RESOURCE due to overlaps, let's go with a
separate CAP.  While for android and cgroup v1, it's nice to have a
finer grained CAP for security control, privilege isolation in cgroup
should also primarily done through hierarchical delegation.  It
doesn't make sense to have another system in parallel.

We can't do it properly on v1 because some controllers aren't properly
hierarchical and delegation model isn't well defined.  e.g. nothing
prevents a process from being pulled across different subtrees with
the same delegation, but v2 can do it properly.  All that's necessary
is to make the CAP test OR'd to other perm checks instead of AND'ing
so that the CAP just allows overriding restrictions expressed through
delegation but it's normally possible to move processes around in
one's own delegated subtree.

Thanks.

-- 
tejun

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups John Stultz <john.stultz@linaro.org> - 2016-12-06 01:30 +0100
  Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups Andy Lutomirski <luto@amacapital.net> - 2016-12-06 01:40 +0100
    Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups "Serge E. Hallyn" <serge@hallyn.com> - 2016-12-06 03:10 +0100
      Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups Tejun Heo <tj@kernel.org> - 2016-12-06 18:00 +0100
    Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups Tejun Heo <tj@kernel.org> - 2016-12-06 18:00 +0100
      Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups Andy Lutomirski <luto@amacapital.net> - 2016-12-06 18:10 +0100
        Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups Tejun Heo <tj@kernel.org> - 2016-12-06 19:20 +0100
          Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups Andy Lutomirski <luto@amacapital.net> - 2016-12-06 19:20 +0100
            Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups Tejun Heo <tj@kernel.org> - 2016-12-06 19:30 +0100
              Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups John Stultz <john.stultz@linaro.org> - 2016-12-09 06:40 +0100
                Re: [RESEND][PATCH v4] cgroup: Use CAP_SYS_RESOURCE to allow a  process to migrate other tasks between cgroups Tejun Heo <tj@kernel.org> - 2016-12-09 14:30 +0100

csiph-web