From: Chen Ridong <chenridong@huawei.com>
To: <tj@kernel.org>, <lizefan.x@bytedance.com>, <hannes@cmpxchg.org>,
<longman@redhat.com>, <mkoutny@suse.com>
Cc: <cgroups@vger.kernel.org>, <linux-kernel@vger.kernel.org>
Subject: [PATCH -next 1/2] cgroup: update comment about delegation
Date: Mon, 12 Aug 2024 07:37:45 +0000 [thread overview]
Message-ID: <20240812073746.3070616-2-chenridong@huawei.com> (raw)
In-Reply-To: <20240812073746.3070616-1-chenridong@huawei.com>
There are three interfaces that delegatee was not allowed to write.
However, cgroup.threads was missed at some place, just add it.
Signed-off-by: Chen Ridong <chenridong@huawei.com>
---
Documentation/admin-guide/cgroup-v2.rst | 6 +++---
kernel/cgroup/cgroup.c | 2 +-
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/Documentation/admin-guide/cgroup-v2.rst b/Documentation/admin-guide/cgroup-v2.rst
index f2d1ec7d6aba..513fd142293c 100644
--- a/Documentation/admin-guide/cgroup-v2.rst
+++ b/Documentation/admin-guide/cgroup-v2.rst
@@ -534,9 +534,9 @@ Because the resource control interface files in a given directory
control the distribution of the parent's resources, the delegatee
shouldn't be allowed to write to them. For the first method, this is
achieved by not granting access to these files. For the second, the
-kernel rejects writes to all files other than "cgroup.procs" and
-"cgroup.subtree_control" on a namespace root from inside the
-namespace.
+kernel rejects writes to all files other than "cgroup.procs",
+"cgroup.threads" and "cgroup.subtree_control" on a namespace
+root from inside the namespace.
The end results are equivalent for both delegation types. Once
delegated, the user can build sub-hierarchy under the directory,
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index a3fa645f8433..8dbe00000fd4 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -4131,7 +4131,7 @@ static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf,
* If namespaces are delegation boundaries, disallow writes to
* files in an non-init namespace root from inside the namespace
* except for the files explicitly marked delegatable -
- * cgroup.procs and cgroup.subtree_control.
+ * cgroup.procs, cgroup.threads and cgroup.subtree_control.
*/
if ((cgrp->root->flags & CGRP_ROOT_NS_DELEGATE) &&
!(cft->flags & CFTYPE_NS_DELEGATABLE) &&
--
2.34.1
next prev parent reply other threads:[~2024-08-12 7:45 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-08-12 7:37 [PATCH -next 0/2] Fixes " Chen Ridong
2024-08-12 7:37 ` Chen Ridong [this message]
2024-08-12 16:57 ` [PATCH -next 1/2] cgroup: update comment " Michal Koutný
2024-08-12 7:37 ` [PATCH -next 2/2] cgroup: Disallow delegatee to write all interfaces outsize of cgroup ns Chen Ridong
2024-08-12 16:57 ` Michal Koutný
2024-08-13 3:48 ` chenridong
2024-08-13 19:02 ` Tejun Heo
2024-08-14 8:09 ` chenridong
2024-08-14 16:52 ` Tejun Heo
2024-08-15 0:50 ` chenridong
2024-08-13 1:35 ` Xiu Jianfeng
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240812073746.3070616-2-chenridong@huawei.com \
--to=chenridong@huawei.com \
--cc=cgroups@vger.kernel.org \
--cc=hannes@cmpxchg.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lizefan.x@bytedance.com \
--cc=longman@redhat.com \
--cc=mkoutny@suse.com \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®