From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752117AbdF1Sov (ORCPT <rfc822;w@1wt.eu>);
        Wed, 28 Jun 2017 14:44:51 -0400
Received: from mail-yw0-f193.google.com ([209.85.161.193]:34429 "EHLO
        mail-yw0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751505AbdF1Son (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Wed, 28 Jun 2017 14:44:43 -0400
Date: Wed, 28 Jun 2017 14:44:41 -0400
From: Tejun Heo <tj@kernel.org>
To: Li Zefan <lizefan@huawei.com>, Johannes Weiner <hannes@cmpxchg.org>
Cc: cgroups@vger.kernel.org, Aravind Anbudurai <aru7@fb.com>,
        linux-kernel@vger.kernel.org, Serge Hallyn <serge@hallyn.com>,
        Eric Biederman <ebiederm@xmission.com>
Subject: Re: [PATCH v2 3/3] cgroup: implement "nsdelegate" mount option
Message-ID: <20170628184441.GC27833@htj.duckdns.org>
References: <20170625042717.GA14158@htj.duckdns.org>
 <20170625042759.GA9644@htj.duckdns.org>
 <20170625042838.GB9644@htj.duckdns.org>
 <20170627183028.GF2289@htj.duckdns.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20170627183028.GF2289@htj.duckdns.org>
User-Agent: Mutt/1.8.3 (2017-05-23)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, Jun 27, 2017 at 02:30:28PM -0400, Tejun Heo wrote:
> Currently, cgroup only supports delegation to !root users and cgroup
> namespaces don't get any special treatments.  This limits the
> usefulness of cgroup namespaces as they by themselves can't be safe
> delegation boundaries.  A process inside a cgroup can change the
> resource control knobs of the parent in the namespace root and may
> move processes in and out of the namespace if cgroups outside its
> namespace are visible somehow.
> 
> This patch adds a new mount option "nsdelegate" which makes cgroup
> namespaces delegation boundaries.  If set, cgroup behaves as if write
> permission based delegation took place at namespace boundaries -
> writes to the resource control knobs from the namespace root are
> denied and migration crossing the namespace boundary aren't allowed
> from inside the namespace.
> 
> This allows cgroup namespace to function as a delegation boundary by
> itself.
> 
> v2: Silently ignore nsdelegate specified on !init mounts.
> 
> Signed-off-by: Tejun Heo <tj@kernel.org>
> Cc: Aravind Anbudurai <aru7@fb.com>
> Cc: Serge Hallyn <serge@hallyn.com>
> Cc: Eric Biederman <ebiederm@xmission.com>

Applying 2-3 to cgroup/for-4.13.

Thanks.

-- 
tejun