Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new cgroup namespaces

From	Tejun Heo <tj@kernel.org>
Newsgroups	linux.kernel
Subject	Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new cgroup namespaces
Date	2016-05-03 18:00 +0200
Message-ID	<ruKTU-2jL-7@gated-at.bofh.it> (permalink)
References	<rumHU-4HQ-9@gated-at.bofh.it> <rumHU-4HQ-13@gated-at.bofh.it> <ruoA2-6AD-21@gated-at.bofh.it> <ruxN0-70R-11@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Hello, Aleksa.

On Tue, May 03, 2016 at 11:52:22AM +1000, Aleksa Sarai wrote:
> However, I agree with James that this patchset isn't ideal (it was my first
> rough attempt). I think I'll get to work on properly virtualising
> /sys/fs/cgroup, which will allow for a new cgroup namespace to modify
> subtrees (but without allowing for cgroup escape) -- by pinning what pid
> namespace the cgroup was created under. We can use the same type of
> virtualization that /proc does (except instead of selectively showing the
> dentries, we selectively show different owners of the dentries).
> 
> Would that be acceptable?

I'm still not sold on the idea.  For better or worse, the permission
model is mostly based on vfs and I don't want to deviate too much as
that's likely to become confusing pretty quickly.  If a sub-hierarchy
is to be delegated, that's upto whomever is controlling cgroup
hierarchy in the sub-domain.  We can expand the perm checks to
consider user namespaces but I'd like to avoid going beyond that.

Thanks.

-- 
tejun

Thread

[PATCH v3 0/2] cgroup: allow management of subtrees by new cgroup namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-02 16:10 +0200
  [PATCH v3 2/2] cgroup: allow management of subtrees by new cgroup namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-02 16:10 +0200
    Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new  cgroup namespaces Tejun Heo <tj@kernel.org> - 2016-05-02 18:10 +0200
      Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new cgroup  namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-03 04:00 +0200
        Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new  cgroup namespaces Tejun Heo <tj@kernel.org> - 2016-05-03 18:00 +0200
          Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new cgroup  namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-04 12:00 +0200
            Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new cgroup  namespaces Aleksa Sarai <asarai@suse.de> - 2016-05-09 16:10 +0200
  [PATCH v3 1/2] cgroup: apply common ancestor cgroup.procs restriction in cgroupv1 Aleksa Sarai <asarai@suse.de> - 2016-05-02 16:10 +0200
    Re: [PATCH v3 1/2] cgroup: apply common ancestor cgroup.procs  restriction in cgroupv1 Tejun Heo <tj@kernel.org> - 2016-05-02 18:10 +0200
      Re: [PATCH v3 1/2] cgroup: apply common ancestor cgroup.procs  restriction in cgroupv1 Aleksa Sarai <asarai@suse.de> - 2016-05-03 03:50 +0200

csiph-web