Messages in this thread | | | Date | Tue, 16 Feb 2016 13:05:51 -0500 | From | Tejun Heo <> | Subject | Re: [PATCH 8/8] Add FS_USERNS_FLAG to cgroup fs |
| |
On Fri, Jan 29, 2016 at 02:54:11AM -0600, serge.hallyn@ubuntu.com wrote: > From: Serge Hallyn <serge.hallyn@ubuntu.com> > > allowing root in a non-init user namespace to mount it. This should > now be safe, because > > 1. non-init-root cannot mount a previously unbound subsystem > 2. the task doing the mount must be privileged with respect to the > user namespace owning the cgroup namespace > 3. the mounted subsystem will have its current cgroup as the root dentry. > the permissions will be unchanged, so tasks will receive no new > privilege over the cgroups which they did not have on the original > mounts. > > Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com>
Applied 1-8 to cgroup/for-4.6-ns w/ trivial stylistic updates.
Thanks.
-- tejun
| |