From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933681AbcECPzQ (ORCPT ); Tue, 3 May 2016 11:55:16 -0400 Received: from mail-yw0-f173.google.com ([209.85.161.173]:34929 "EHLO mail-yw0-f173.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755920AbcECPzN (ORCPT ); Tue, 3 May 2016 11:55:13 -0400 Date: Tue, 3 May 2016 11:55:11 -0400 From: Tejun Heo To: Aleksa Sarai Cc: Li Zefan , Johannes Weiner , cgroups@vger.kernel.org, linux-kernel@vger.kernel.org, dev@opencontainers.org, Aleksa Sarai , James Bottomley Subject: Re: [PATCH v3 2/2] cgroup: allow management of subtrees by new cgroup namespaces Message-ID: <20160503155511.GA7110@mtj.duckdns.org> References: <1462197681-6879-1-git-send-email-asarai@suse.de> <1462197681-6879-3-git-send-email-asarai@suse.de> <20160502160604.GR7822@mtj.duckdns.org> <57280456.1090106@suse.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <57280456.1090106@suse.de> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hello, Aleksa. On Tue, May 03, 2016 at 11:52:22AM +1000, Aleksa Sarai wrote: > However, I agree with James that this patchset isn't ideal (it was my first > rough attempt). I think I'll get to work on properly virtualising > /sys/fs/cgroup, which will allow for a new cgroup namespace to modify > subtrees (but without allowing for cgroup escape) -- by pinning what pid > namespace the cgroup was created under. We can use the same type of > virtualization that /proc does (except instead of selectively showing the > dentries, we selectively show different owners of the dentries). > > Would that be acceptable? I'm still not sold on the idea. For better or worse, the permission model is mostly based on vfs and I don't want to deviate too much as that's likely to become confusing pretty quickly. If a sub-hierarchy is to be delegated, that's upto whomever is controlling cgroup hierarchy in the sub-domain. We can expand the perm checks to consider user namespaces but I'd like to avoid going beyond that. Thanks. -- tejun