Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1495571

Re: [RFC][PATCH 0/2] Another pass at Android style loosening of cgroup attach permissions

Show all headers | View raw

Hello, John.

On Tue, Oct 04, 2016 at 11:01:12AM -0700, John Stultz wrote:
> So to make sure I understand your suggestion, you're suggesting the
> cgroupfs files like:
> cpuctrl/tasks,
> cpuctrl/bg_non_interactive/tasks,
> cpuset/foreground/tasks,
> cpuset/background/tasks,
> etc
> use ACL permissions to specify the specific uids that can write to
> them? I guess this would be conceptually similar to just setting the
> owner to the system task, no?  Though I'm not sure that would be

Yeah, finer grained but essentially just giving write perms.

> sufficient since it would still fail the
> cgroup_procs_write_permission() checks. Or are you suggesting we add
> extra logic to make the file owner uid as sufficient to change other
> tasks?

Hah, now I'm not sure how this is supposed to work inside a userns as
it's checking against GLOBAL_ROOT_UID.  cc'ing Serge.  Serge, can you
please have a look?

But back on subject, yeah, I think a capability based approach is
better here too.  No idea how difficult it is to add a new CAP but I
think it's worth trying.  Can you please spin up a patch?

Thanks!

-- 
tejun

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC][PATCH 0/2] Another pass at Android style loosening of cgroup attach permissions John Stultz <john.stultz@linaro.org> - 2016-10-04 06:50 +0200
  [PATCH 2/2] cgroup: Add a allow_attach policy for Android John Stultz <john.stultz@linaro.org> - 2016-10-04 06:50 +0200
    Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android John Stultz <john.stultz@linaro.org> - 2016-10-05 21:20 +0200
      Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-07 00:50 +0200
        Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-07 01:00 +0200
    Re: [PATCH 2/2] cgroup: Add a allow_attach policy for Android Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-05 21:20 +0200
  [PATCH 1/2] cgroup: Add generic cgroup subsystem permission checks John Stultz <john.stultz@linaro.org> - 2016-10-04 06:50 +0200
    Re: [PATCH 1/2] cgroup: Add generic cgroup subsystem permission  checks Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-05 21:10 +0200
      Re: [PATCH 1/2] cgroup: Add generic cgroup subsystem permission checks John Stultz <john.stultz@linaro.org> - 2016-10-05 21:20 +0200
        Re: [PATCH 1/2] cgroup: Add generic cgroup subsystem permission checks Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2016-10-05 21:30 +0200
  Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 18:20 +0200
    Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions John Stultz <john.stultz@linaro.org> - 2016-10-04 20:10 +0200
    Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions John Stultz <john.stultz@linaro.org> - 2016-10-04 20:10 +0200
      Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 21:40 +0200
        Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 21:50 +0200
        Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions John Stultz <john.stultz@linaro.org> - 2016-10-04 21:50 +0200
        Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions "Serge E. Hallyn" <serge@hallyn.com> - 2016-10-04 22:20 +0200
          Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 22:40 +0200
            Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions "Serge E. Hallyn" <serge@hallyn.com> - 2016-10-04 23:30 +0200
              Re: [RFC][PATCH 0/2] Another pass at Android style loosening of  cgroup attach permissions Tejun Heo <tj@kernel.org> - 2016-10-04 23:40 +0200

csiph-web