From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754495AbcEBQDn (ORCPT ); Mon, 2 May 2016 12:03:43 -0400 Received: from mail-yw0-f170.google.com ([209.85.161.170]:32822 "EHLO mail-yw0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754088AbcEBQDe (ORCPT ); Mon, 2 May 2016 12:03:34 -0400 Date: Mon, 2 May 2016 12:03:32 -0400 From: Tejun Heo To: Aleksa Sarai Cc: Li Zefan , Johannes Weiner , cgroups@vger.kernel.org, linux-kernel@vger.kernel.org, dev@opencontainers.org, Aleksa Sarai Subject: Re: [PATCH v3 1/2] cgroup: apply common ancestor cgroup.procs restriction in cgroupv1 Message-ID: <20160502160332.GQ7822@mtj.duckdns.org> References: <1462197681-6879-1-git-send-email-asarai@suse.de> <1462197681-6879-2-git-send-email-asarai@suse.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1462197681-6879-2-git-send-email-asarai@suse.de> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, May 03, 2016 at 12:01:20AM +1000, Aleksa Sarai wrote: > The common ancestor restriction for moving tasks between cgroups (the > process moving the task must have the right to write to cgroup.procs in > both the destination and common ancestor cgroup) only applied for > cgroupv2 (cgroups in the default hierarchy). This meant that there was a > different policy for unprivileged users in the different cgroup > hierarchies. > > Update cgroup_procs_write_permission() to apply the cgroup.procs > restriction regardless of the cgroup root of the destination cgroup. > However, if the task doesn't have any association with the destination > hierarchy, there's no permission check to be done. In addition, if the > destination cgroup is a descendant of the task's current cgroup then > there are no further permission checks. This is important for > unprivileged processes creating subtrees. So, you can't apply a new restriction like this retro-actively to cgroup v1 hierarchies. Thanks. -- tejun