From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754348AbcEBQGK (ORCPT ); Mon, 2 May 2016 12:06:10 -0400 Received: from mail-yw0-f173.google.com ([209.85.161.173]:33479 "EHLO mail-yw0-f173.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752805AbcEBQGH (ORCPT ); Mon, 2 May 2016 12:06:07 -0400 Date: Mon, 2 May 2016 12:06:04 -0400 From: Tejun Heo To: Aleksa Sarai Cc: Li Zefan , Johannes Weiner , cgroups@vger.kernel.org, linux-kernel@vger.kernel.org, dev@opencontainers.org, Aleksa Sarai Subject: Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new cgroup namespaces Message-ID: <20160502160604.GR7822@mtj.duckdns.org> References: <1462197681-6879-1-git-send-email-asarai@suse.de> <1462197681-6879-3-git-send-email-asarai@suse.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1462197681-6879-3-git-send-email-asarai@suse.de> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hello, On Tue, May 03, 2016 at 12:01:21AM +1000, Aleksa Sarai wrote: > Allow an unprivileged processes to control subtrees of their associated > cgroup, a necessary feature if an unprivileged container (set up with an > unprivileged user namespace) wishes to take advantage of cgroups for its > own subprocesses. > > Change the mode of the cgroup directory for each cgroup association, > allowing the process to create subtrees and modify the limits of the > subtrees *without* allowing the process to modify its own limits. Due to > the cgroup core restrictions and unix permission model, this allows for > processes to create new subtrees without breaking the cgroup limits for > the process. I don't get why this is necessary. What's wrong with the parent setting up permission correctly for the namespace? Thanks. -- tejun