Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1495543

Re: [RFC][PATCH 0/2] Another pass at Android style loosening of cgroup attach permissions

Show all headers | View raw

On Tue, Oct 4, 2016 at 9:16 AM, Tejun Heo <tj@kernel.org> wrote:
> On Mon, Oct 03, 2016 at 09:41:28PM -0700, John Stultz wrote:
>> The migration of a task from the foreground to background, or to
>> elevate a task to audio priority, may be done by system service that
>> does not run as root. So this patch allows processes with CAP_SYS_NICE
>> to be able to migrate tasks between cgroups.  I suspect if there was a
>> specific cap (CAP_SYS_CHANGE_CGROUP) for this, it would be usable here,
>> but in its absence, they've overloaded CAP_SYS_NICE for this use.
>
> CAP_SYS_RESOURCE won't do?

Oh, and I'll have to look into this one to see what CAP_SYS_RESOURCE
actually allows. We ran into trouble in the past changing the CAPs
required to something higher-level, which then causes trouble because
they want to avoid elevating permissions on system tasks and keep them
as restricted as possible.

thans
-john

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC][PATCH 0/2] Another pass at Android style loosening of cgroup attach permissions John Stultz <john.stultz@linaro.org> - 2016-10-04 06:50 +0200
  [PATCH 2/2] cgroup: Add a allow_attach policy for Android John Stultz <john.stultz@linaro.org> - 2016-10-04 06:50 +0200
    Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android John Stultz <john.stultz@linaro.org> - 2016-10-05 21:20 +0200
      Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-07 00:50 +0200
        Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-07 01:00 +0200
    Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-05 21:20 +0200
  [PATCH 1/2] cgroup: Add generic cgroup subsystem permission checks John Stultz <john.stultz@linaro.org> - 2016-10-04 06:50 +0200
    Re: [PATCH 1/2] cgroup: Add generic cgroup subsystem permission  checks Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-05 21:10 +0200
      Re: [PATCH 1/2] cgroup: Add generic cgroup subsystem permission checks John Stultz <john.stultz@linaro.org> - 2016-10-05 21:20 +0200
        Re: [PATCH 1/2] cgroup: Add generic cgroup subsystem permission checks Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-05 21:30 +0200
  Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 18:20 +0200
    Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions John Stultz <john.stultz@linaro.org> - 2016-10-04 20:10 +0200
    Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions John Stultz <john.stultz@linaro.org> - 2016-10-04 20:10 +0200
      Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 21:40 +0200
        Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 21:50 +0200
        Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions John Stultz <john.stultz@linaro.org> - 2016-10-04 21:50 +0200
        Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions "Serge E. Hallyn" <serge@hallyn.com> - 2016-10-04 22:20 +0200
          Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 22:40 +0200
            Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions "Serge E. Hallyn" <serge@hallyn.com> - 2016-10-04 23:30 +0200
              Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 23:40 +0200

csiph-web