Re: [RFC][PATCH 0/2] Another pass at Android style loosening of cgroup attach permissions

[Tejun Heo <tj@kernel.org>]

On Tue, Oct 04, 2016 at 04:26:43PM -0500, Serge E. Hallyn wrote:
> Quoting Tejun Heo (tj@kernel.org):
> > Hello, Serge.
> > 
> > On Tue, Oct 04, 2016 at 03:18:40PM -0500, Serge E. Hallyn wrote:
> > > how about changing the GLOBAL_ROOT_UID check with a targeted
> > > capability check, like
> > > 
> > > 	if (!ns_capable(tcred->user_ns, CAP_SYS_NICE) &&
> > >             !uid_eq(cred->euid, tcred->uid) &&
> > >             !uid_eq(cred->euid, tcred->suid))
> > > 		ret = -EACCES;
> > > 
> > > where the actual capability to use may require some thought.
> > 
> > Yeah, that's the direction I'm thinking too.  We can't use
> > CAP_SYS_NICE in general tho.  Let's see if a dedicated CAP sticks.
> 
> One possibility would be to let each cgroup subsystem define
> a move_caps capability mask which is required over the target
> task.  And add a new CAP_CGROUP which always suffices?

As I wrote in another reply, I really don't wanna do that.  It brings
in the question about control knob permissions too and makes the
permission checks a lot more difficult to predit.  I'd much rather
just get rid of the extra checks, at least on the v2 hierarchy.  The
extra checks are protecting against pulling in random processes into a
delegated subtree and v2 hierarchy already has a protection against
that.

Thanks.

-- 
tejun