lkml.org 
[lkml]   [2016]   [Dec]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v5] cgroup: Add new capability to allow a process to migrate other tasks between cgroups
Hello, Casey.

On Tue, Dec 13, 2016 at 10:32:14AM -0800, Casey Schaufler wrote:
> > The trouble is that CAP_SYS_NICE or _RESOURCE (which was tried in an
> > earlier version of this patch) aren't necessarily appropriate for
> > non-android systems. See Andy's objection here:
> > https://lkml.org/lkml/2016/11/8/946
>
> Then we need to see what those as-yet-unimplemented systems
> require and how to address them. I don't think that taking
> the "someone might want it" approach is really appropriate.

I understands that there can be reservations regarding adding a new
CAP but this isn't about someone possibly wanting it in the future.
It's more about overloading existing CAPs leading to permitting
unintended operations. e.g. ppl who've been delegating
CAP_SYS_RESOURCES would automatically end up delegating cgroup
organization without intending so. Using an existing cap would have
been nice but it just doesn't look like we have a good one to
overload.

Thanks.

--
tejun

\
 
 \ /
  Last update: 2016-12-13 19:47    [W:0.462 / U:0.500 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site