From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752108AbcGRQSi (ORCPT ); Mon, 18 Jul 2016 12:18:38 -0400 Received: from mx2.suse.de ([195.135.220.15]:54944 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751563AbcGRQSe (ORCPT ); Mon, 18 Jul 2016 12:18:34 -0400 From: Aleksa Sarai To: Greg Kroah-Hartman , Tejun Heo , Li Zefan , Johannes Weiner , "Serge E. Hallyn" , Aditya Kali , Chris Wilson Cc: linux-kernel@vger.kernel.org, cgroups@vger.kernel.org, Christian Brauner , Aleksa Sarai , dev@opencontainers.org Subject: [PATCH v1 3/3] cgroup: relax common ancestor restriction for direct descendants Date: Tue, 19 Jul 2016 02:18:16 +1000 Message-Id: <20160718161816.13040-4-asarai@suse.de> X-Mailer: git-send-email 2.9.0 In-Reply-To: <20160718161816.13040-1-asarai@suse.de> References: <20160718161816.13040-1-asarai@suse.de> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If we're moving from a parent to a direct descendant, the only end result (on cgroupv2 hierarchies) is that the process experiences more restrictive resource limits. Thus, there's no reason to restrict processes from moving to direct descendants based on whether or not they have cgroup.procs write access to their current cgroup. This is important for unprivileged subtree management, as it allows unprivileged processes to move to their newly create subtrees. Cc: dev@opencontainers.org Signed-off-by: Aleksa Sarai --- kernel/cgroup.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/kernel/cgroup.c b/kernel/cgroup.c index 4559baa7eabd..fa403357ba91 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -2859,14 +2859,22 @@ static int cgroup_procs_write_permission(struct task_struct *task, cgrp = task_cgroup_from_root(task, &cgrp_dfl_root); spin_unlock_irq(&css_set_lock); - while (!cgroup_is_descendant(dst_cgrp, cgrp)) - cgrp = cgroup_parent(cgrp); - - ret = -ENOMEM; - inode = kernfs_get_inode(sb, cgrp->procs_file.kn); - if (inode) { - ret = inode_permission(inode, MAY_WRITE); - iput(inode); + /* + * If we are moving to a descendant of our current cgroup, we + * can only further restrict the cgroup limits we must follow. + * Thus, it doesn't make sense to restrict the cgroup.procs + * write. + */ + if (!cgroup_is_descendant(dst_cgrp, cgrp)) { + while (!cgroup_is_descendant(dst_cgrp, cgrp)) + cgrp = cgroup_parent(cgrp); + + ret = -ENOMEM; + inode = kernfs_get_inode(sb, cgrp->procs_file.kn); + if (inode) { + ret = inode_permission(inode, MAY_WRITE); + iput(inode); + } } } -- 2.9.0