lkml.org 
[lkml]   [2013]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [RFC PATCH 1/2] devices cgroup: allow can_attach() if ns_capable
    On Wed, Oct 23, 2013 at 12:41:30AM +0000, Serge E. Hallyn wrote:
    > Quoting Tejun Heo (tj@kernel.org):
    > > On Tue, Jul 23, 2013 at 2:38 PM, Serge Hallyn <serge.hallyn@ubuntu.com> wrote:
    > > > This doesn't delegate it into the container. It allows me, on the host,
    > > > to set the cgroup for a container.
    > >
    > > Hmmm? I'm a bit confused. Isn't the description saying that the patch
    > > allows pseudo-root in userns to change cgroup membership even if it
    > > isn't actually root?
    > >
    > > Besides, I find the whole check rather bogus and would actually much
    > > prefer just nuking the check and just follow the standard permission
    > > checks.
    >
    > Can we please nuke it like this then?
    >
    > From b840083ec8fa1f0645ae925c79db3dc51edd019c Mon Sep 17 00:00:00 2001
    > From: Serge Hallyn <serge.hallyn@ubuntu.com>
    > Date: Wed, 23 Oct 2013 01:34:00 +0200
    > Subject: [PATCH 1/1] device_cgroup: remove can_attach
    >
    > It is really only wanting to duplicate a check which is already done by the
    > cgroup subsystem.
    >
    > With this patch, user jdoe still cannot move pid 1 into a devices cgroup
    > he owns, but now he can move his own other tasks into devices cgroups.
    >
    > Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
    > Cc: Aristeu Rozanski <aris@redhat.com>
    > Cc: Tejun Heo <tj@kernel.org>

    Applied to cgroup/for-3.13. Thanks.

    --
    tejun


    \
     
     \ /
      Last update: 2013-10-24 13:21    [W:3.192 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site