[lkml]   [2014]   [Apr]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH 1/2] net: Implement SO_PEERCGROUP
On Tue, Apr 15, 2014 at 02:54:02PM -0700, Andy Lutomirski wrote:
> On Tue, Apr 15, 2014 at 2:15 PM, Vivek Goyal <> wrote:
> > Implement SO_PEERCGROUP along the lines of SO_PEERCRED. This returns the
> > cgroup of first mounted hierarchy of the task. For the case of client,
> > it represents the cgroup of client at the time of opening the connection.
> > After that client cgroup might change.
> >
> > This works only for unix stream sockets.
> I still don't understand why this is useful when SCM_CGROUP exists.

I think this is more lightweight as compared to SCM_CGROUP. Information
is stored per connection as opposed to per message.

So if user space has created a system where unpriviliged processed have
been locked in cgroups and they can't escape those cgroups, then
SO_PEERCRED should be sufficient and one does not have to use SCM_CGROUP.


 \ /
  Last update: 2014-04-16 02:41    [W:0.071 / U:5.844 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site