Messages in this thread |  | | From | John Stultz <> | Date | Tue, 4 Oct 2016 11:03:43 -0700 | Subject | Re: [RFC][PATCH 0/2] Another pass at Android style loosening of cgroup attach permissions |
| |
On Tue, Oct 4, 2016 at 9:16 AM, Tejun Heo <tj@kernel.org> wrote: > On Mon, Oct 03, 2016 at 09:41:28PM -0700, John Stultz wrote: >> The migration of a task from the foreground to background, or to >> elevate a task to audio priority, may be done by system service that >> does not run as root. So this patch allows processes with CAP_SYS_NICE >> to be able to migrate tasks between cgroups. I suspect if there was a >> specific cap (CAP_SYS_CHANGE_CGROUP) for this, it would be usable here, >> but in its absence, they've overloaded CAP_SYS_NICE for this use. > > CAP_SYS_RESOURCE won't do?
Oh, and I'll have to look into this one to see what CAP_SYS_RESOURCE actually allows. We ran into trouble in the past changing the CAPs required to something higher-level, which then causes trouble because they want to avoid elevating permissions on system tasks and keep them as restricted as possible.
thans -john
|  |