From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755278AbcITNx1 (ORCPT ); Tue, 20 Sep 2016 09:53:27 -0400 Received: from mail-yw0-f193.google.com ([209.85.161.193]:35858 "EHLO mail-yw0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755212AbcITNxV (ORCPT ); Tue, 20 Sep 2016 09:53:21 -0400 Date: Tue, 20 Sep 2016 09:53:08 -0400 From: Tejun Heo To: =?iso-8859-1?Q?Micka=EBl_Sala=FCn?= Cc: linux-kernel@vger.kernel.org, Alexei Starovoitov , Andy Lutomirski , Daniel Borkmann , Daniel Mack , "David S . Miller" , James Morris , Kees Cook , Martin KaFai Lau , cgroups@vger.kernel.org Subject: Re: [PATCH v1] cgroup,bpf: Add access check for cgroup_get_from_fd() Message-ID: <20160920135308.GA17513@htj.duckdns.org> References: <20160919224913.24808-1-mic@digikod.net> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20160919224913.24808-1-mic@digikod.net> User-Agent: Mutt/1.7.0 (2016-08-17) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hello, On Tue, Sep 20, 2016 at 12:49:13AM +0200, Mickaël Salaün wrote: > Add security access check for cgroup backed FD. The "cgroup.procs" file > of the corresponding cgroup should be readable to identify the cgroup, > and writable to prove that the current process can manage this cgroup > (e.g. through delegation). This is similar to the check done by > cgroup_procs_write_permission(). Can you please explain why this change is beneficial? Thanks. -- tejun