Re: [RFC v2 09/10] landlock: Handle cgroups

From	Alexei Starovoitov <alexei.starovoitov@gmail.com>
Newsgroups	linux.kernel
Subject	Re: [RFC v2 09/10] landlock: Handle cgroups
Date	2016-08-27 20:20 +0200
Message-ID	<saQmZ-7TN-5@gated-at.bofh.it> (permalink)
References	(1 earlier) <sa0op-8hT-1@gated-at.bofh.it> <saf46-Zl-15@gated-at.bofh.it> <sar5f-nz-19@gated-at.bofh.it> <sayq5-56V-5@gated-at.bofh.it> <saGnD-1EB-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Sat, Aug 27, 2016 at 12:30:36AM -0700, Andy Lutomirski wrote:
> > cgroup is the common way to group multiple tasks.
> > Without cgroup only parent<->child relationship will be possible,
> > which will limit usability of such lsm to a master task that controls
> > its children. Such api restriction would have been ok, if we could
> > extend it in the future, but unfortunately task-centric won't allow it
> > without creating a parallel lsm that is cgroup based.
> > Therefore I think we have to go with cgroup-centric api and your
> > application has to use cgroups from the start though only parent-child
> > would have been enough.
> > Also I don't think the kernel can afford two bpf based lsm. One task
> > based and another cgroup based, so we have to find common ground
> > that suits both use cases.
> > Having unprivliged access is a subset. There is no strong reason why
> > cgroup+lsm+bpf should be limited to root only always.
> > When we can guarantee no pointer leaks, we can allow unpriv.
> 
> I don't really understand what you mean.  In the context of landlock,
> which is a *sandbox*, can one of you explain a use case that
> materially benefits from this type of cgroup usage?  I haven't thought
> of one.

In case of seccomp-like sandbox where parent controls child processes
cgroup is not needed. It's needed when container management software
needs to control a set of applications. If we can have one bpf-based lsm
that works via cgroup and without, I'd be fine with it. Right now
I haven't seen a plausible proposal to do that. Therefore cgroup based
api is a common api that works for sandbox as well, though requiring
parent to create a cgroup just to control a single child is cumbersome.

Thread

[RFC v2 09/10] landlock: Handle cgroups Mickaël Salaün <mic@digikod.net> - 2016-08-25 12:50 +0200
  Re: [RFC v2 09/10] landlock: Handle cgroups Andy Lutomirski <luto@amacapital.net> - 2016-08-25 13:20 +0200
    Re: [RFC v2 09/10] landlock: Handle cgroups Mickaël Salaün <mic@digikod.net> - 2016-08-25 16:50 +0200
      Re: [RFC v2 09/10] landlock: Handle cgroups Tejun Heo <tj@kernel.org> - 2016-08-26 15:00 +0200
      Re: [RFC v2 09/10] landlock: Handle cgroups Andy Lutomirski <luto@amacapital.net> - 2016-08-26 16:30 +0200
        Re: [RFC v2 09/10] landlock: Handle cgroups Tejun Heo <tj@kernel.org> - 2016-08-26 18:00 +0200
  Re: [RFC v2 09/10] landlock: Handle cgroups Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-08-26 04:30 +0200
    Re: [RFC v2 09/10] landlock: Handle cgroups Mickaël Salaün <mic@digikod.net> - 2016-08-26 17:20 +0200
      Re: [RFC v2 09/10] landlock: Handle cgroups Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-08-27 01:10 +0200
        Re: [RFC v2 09/10] landlock: Handle cgroups Andy Lutomirski <luto@amacapital.net> - 2016-08-27 09:40 +0200
          Re: [RFC v2 09/10] landlock: Handle cgroups Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-08-27 20:20 +0200
            Re: [RFC v2 09/10] landlock: Handle cgroups Andy Lutomirski <luto@amacapital.net> - 2016-08-28 10:20 +0200
        Re: [RFC v2 09/10] landlock: Handle cgroups (performance) Mickaël Salaün <mic@digikod.net> - 2016-08-27 16:20 +0200
          Re: [RFC v2 09/10] landlock: Handle cgroups (performance) Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-08-27 20:10 +0200
            Re: [RFC v2 09/10] landlock: Handle cgroups (performance) Mickaël Salaün <mic@digikod.net> - 2016-08-27 21:40 +0200
              Re: [RFC v2 09/10] landlock: Handle cgroups (performance) Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-08-27 22:50 +0200
                Re: [RFC v2 09/10] landlock: Handle cgroups (performance) Mickaël Salaün <mic@digikod.net> - 2016-08-27 23:20 +0200
                Re: [RFC v2 09/10] landlock: Handle cgroups (performance) Andy Lutomirski <luto@amacapital.net> - 2016-08-28 10:20 +0200
                Re: [RFC v2 09/10] landlock: Handle cgroups (performance) Mickaël Salaün <mic@digikod.net> - 2016-08-28 11:50 +0200
                Re: [RFC v2 09/10] landlock: Handle cgroups (performance) Andy Lutomirski <luto@amacapital.net> - 2016-08-30 21:00 +0200
                Re: [RFC v2 09/10] landlock: Handle cgroups (performance) Mickaël Salaün <mic@digikod.net> - 2016-08-30 22:30 +0200
                Re: [RFC v2 09/10] landlock: Handle cgroups (performance) Andy Lutomirski <luto@amacapital.net> - 2016-08-30 22:30 +0200
                Re: [RFC v2 09/10] landlock: Handle cgroups (performance) Mickaël Salaün <mic@digikod.net> - 2016-08-30 22:40 +0200
                Re: [RFC v2 09/10] landlock: Handle cgroups (performance) Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-08-30 23:00 +0200
                Re: [RFC v2 09/10] landlock: Handle cgroups (performance) Andy Lutomirski <luto@amacapital.net> - 2016-08-30 23:50 +0200
                Re: [RFC v2 09/10] landlock: Handle cgroups (performance) Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-08-31 03:40 +0200
                Re: [RFC v2 09/10] landlock: Handle cgroups (performance) Andy Lutomirski <luto@amacapital.net> - 2016-08-31 05:30 +0200
        Re: [RFC v2 09/10] landlock: Handle cgroups (netfilter match) Mickaël Salaün <mic@digikod.net> - 2016-08-27 16:30 +0200
          Re: [RFC v2 09/10] landlock: Handle cgroups (netfilter match) Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-08-27 20:40 +0200
        Re: [RFC v2 09/10] landlock: Handle cgroups (program types) Mickaël Salaün <mic@digikod.net> - 2016-08-27 16:40 +0200
          Re: [RFC v2 09/10] landlock: Handle cgroups (program types) Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-08-27 20:30 +0200
            Re: [RFC v2 09/10] landlock: Handle cgroups (program types) Mickaël Salaün <mic@digikod.net> - 2016-08-27 22:00 +0200
              Re: [RFC v2 09/10] landlock: Handle cgroups (program types) Alexei Starovoitov <alexei.starovoitov@gmail.com> - 2016-08-27 23:00 +0200
                Re: [RFC v2 09/10] landlock: Handle cgroups (program types) Mickaël Salaün <mic@digikod.net> - 2016-08-27 23:20 +0200

csiph-web