Messages in this thread | | | Date | Wed, 23 Nov 2011 08:24:17 -0800 | From | Tejun Heo <> | Subject | Re: [RFC][PATCH 0/3] fork: Add the ability to create tasks with given pids |
| |
Hello,
On Wed, Nov 23, 2011 at 04:20:44PM +0000, Pedro Alves wrote: > > Would CAP_CHECKPOINT be a shame too? > > I think CAP_CHECKPOINT (or something through some LSM) would be > definitely better. > > > I'm reluctant about priviledge > > through fd inheritance mostly because of its unusualness. I don't > > think priv management is a good problem space for small creative > > solutions. We're much better off with mundane mechanisms which people > > are already familiar with and is easy to account for. > > fd inheritance wouldn't work for gdb; a user spawned gdb > wouldn't inherit an open fd to kernel.ns_last_pid from anywhere.
I see. So, let's do it for root for now and later add finer grained CAP as necessary/viable. Pavel, what do you think?
Thanks.
-- tejun
| |