Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1540800

Re: [PATCH v5] cgroup: Add new capability to allow a process to migrate other tasks between cgroups

Show all headers | View raw

On Mon, Dec 12, 2016 at 5:39 PM, John Stultz <john.stultz@linaro.org> wrote:
> This patch adds CAP_GROUP_MIGRATE and logic to allows a process
> to migrate other tasks between cgroups.
>
> In Android (where this feature originated), the ActivityManager
> tracks various application states (TOP_APP, FOREGROUND,
> BACKGROUND, SYSTEM, etc), and then as applications change
> states, the SchedPolicy logic will migrate the application tasks
> between different cgroups used to control the different
> application states (for example, there is a background cpuset
> cgroup which can limit background tasks to stay on one low-power
> cpu, and the bg_non_interactive cpuctrl cgroup can then further
> limit those background tasks to a small percentage of that one
> cpu's cpu time).
>
> However, for security reasons, Android doesn't want to make the
> system_server (the process that runs the ActivityManager and
> SchedPolicy logic), run as root. So in the Android common.git
> kernel, they have some logic to allow cgroups to loosen their
> permissions so CAP_SYS_NICE tasks can migrate other tasks between
> cgroups.
>
> I feel the approach taken there overloads CAP_SYS_NICE a bit much
> for non-android environments. Efforts to re-use CAP_SYS_RESOURCE
> for this purpose (which Android has since adopted) was also
> stymied by concerns about risks from future cgroups that could be
> considered "dangerous" by how they might change system semantics.
>
> So to avoid overlapping usage, this patch adds a brand new
> process capability flag (CAP_CGROUP_MIGRATE), and uses it when
> checking if a task can migrate other tasks between cgroups.
>
> I've tested this with AOSP master (though its a bit hacked in as
> I still need to properly get the selinux bits aware of the new
> capability bit) with selinux set to permissive and it seems to be
> working well.
>
> Thoughts and feedback would be appreciated!
>
> Cc: Tejun Heo <tj@kernel.org>
> Cc: Li Zefan <lizefan@huawei.com>
> Cc: Jonathan Corbet <corbet@lwn.net>
> Cc: cgroups@vger.kernel.org
> Cc: Android Kernel Team <kernel-team@android.com>
> Cc: Rom Lemarchand <romlem@android.com>
> Cc: Colin Cross <ccross@android.com>
> Cc: Dmitry Shmidt <dimitrysh@google.com>
> Cc: Todd Kjos <tkjos@google.com>
> Cc: Christian Poetzsch <christian.potzsch@imgtec.com>
> Cc: Amit Pundir <amit.pundir@linaro.org>
> Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Serge E. Hallyn <serge@hallyn.com>
> Cc: Andy Lutomirski <luto@amacapital.net>
> Cc: linux-api@vger.kernel.org
> Acked-by: Serge Hallyn <serge@hallyn.com>

After sending this I just realized that this is changed enough I
should probably remove Serge's Acked-by here. Apologies.

But otherwise feedback on this would be appreciated!

thanks
-john

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v5] cgroup: Add new capability to allow a process to migrate other tasks between cgroups John Stultz <john.stultz@linaro.org> - 2016-12-13 02:40 +0100
  Re: [PATCH v5] cgroup: Add new capability to allow a process to  migrate other tasks between cgroups John Stultz <john.stultz@linaro.org> - 2016-12-13 02:50 +0100
  Re: [PATCH v5] cgroup: Add new capability to allow a process to  migrate other tasks between cgroups "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-12-13 10:50 +0100
    Re: [PATCH v5] cgroup: Add new capability to allow a process to  migrate other tasks between cgroups John Stultz <john.stultz@linaro.org> - 2016-12-13 17:30 +0100
      Re: [PATCH v5] cgroup: Add new capability to allow a process to  migrate other tasks between cgroups John Stultz <john.stultz@linaro.org> - 2016-12-13 19:50 +0100
        Re: [PATCH v5] cgroup: Add new capability to allow a process to  migrate other tasks between cgroups Tejun Heo <tj@kernel.org> - 2016-12-13 20:00 +0100
      Re: [PATCH v5] cgroup: Add new capability to allow a process to  migrate other tasks between cgroups Tejun Heo <tj@kernel.org> - 2016-12-13 19:50 +0100
    Re: [PATCH v5] cgroup: Add new capability to allow a process to  migrate other tasks between cgroups Casey Schaufler <casey@schaufler-ca.com> - 2016-12-13 17:40 +0100
      Re: [PATCH v5] cgroup: Add new capability to allow a process to  migrate other tasks between cgroups John Stultz <john.stultz@linaro.org> - 2016-12-13 18:00 +0100
        Re: [PATCH v5] cgroup: Add new capability to allow a process to  migrate other tasks between cgroups Casey Schaufler <casey@schaufler-ca.com> - 2016-12-13 18:20 +0100
          Re: [PATCH v5] cgroup: Add new capability to allow a process to  migrate other tasks between cgroups John Stultz <john.stultz@linaro.org> - 2016-12-13 18:40 +0100
            Re: [PATCH v5] cgroup: Add new capability to allow a process to  migrate other tasks between cgroups Casey Schaufler <casey@schaufler-ca.com> - 2016-12-13 18:50 +0100
              Re: [PATCH v5] cgroup: Add new capability to allow a process to  migrate other tasks between cgroups John Stultz <john.stultz@linaro.org> - 2016-12-13 19:20 +0100
                Re: [PATCH v5] cgroup: Add new capability to allow a process to  migrate other tasks between cgroups Casey Schaufler <casey@schaufler-ca.com> - 2016-12-13 19:40 +0100
                Re: [PATCH v5] cgroup: Add new capability to allow a process to  migrate other tasks between cgroups Tejun Heo <tj@kernel.org> - 2016-12-13 19:50 +0100

csiph-web