Messages in this thread |  | | From | John Stultz <> | Date | Tue, 4 Oct 2016 20:00:18 -0700 | Subject | Re: [RFC][PATCH] cgroup: Add new capability to allow a process to migrate other tasks between cgroups |
| |
On Tue, Oct 4, 2016 at 5:38 PM, Serge E. Hallyn <serge@hallyn.com> wrote: > Quoting John Stultz (john.stultz@linaro.org): >> So this patch, as suggested by Tejun, simply adds a new process >> capability flag (CAP_CGROUP_MIGRATE_TASK), and uses it when checking > > So realistically, what all can this mean? Freezing tasks, changing > cpu/memory limits, changing network and disk throughput, forbid forking, > and (most importantly) forbid access to certain devices. > > I think that's all ok. (And we still separately check for inode write > perms.)
Sounds good.
> If anything I'd say the GLOBAL_ROOT_UID check could be taken out since > otherwise a host-root task effectively cannot drop this capability.
Is this ok to leave for a separate patch?
> Acked-by: Serge Hallyn <serge@hallyn.com>
Thanks for the review!
Unless there's other feedback, I'll sit on this until the merge window is over and then resubmit for consideration for 4.10.
thanks -john
|  |