From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932284AbcGTWxU (ORCPT ); Wed, 20 Jul 2016 18:53:20 -0400 Received: from mx2.suse.de ([195.135.220.15]:37179 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753060AbcGTWxS (ORCPT ); Wed, 20 Jul 2016 18:53:18 -0400 Subject: Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for direct descendants To: Tejun Heo References: <20160718161816.13040-1-asarai@suse.de> <20160718161816.13040-4-asarai@suse.de> <20160720155147.GG4574@htj.duckdns.org> Cc: Greg Kroah-Hartman , Li Zefan , Johannes Weiner , "Serge E. Hallyn" , Aditya Kali , Chris Wilson , linux-kernel@vger.kernel.org, cgroups@vger.kernel.org, Christian Brauner , dev@opencontainers.org, James Bottomley From: Aleksa Sarai Message-ID: <6e975d80-4077-fb8b-ec84-708e37c8e149@suse.de> Date: Thu, 21 Jul 2016 08:58:32 +1000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 In-Reply-To: <20160720155147.GG4574@htj.duckdns.org> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org >> If we're moving from a parent to a direct descendant, the only end >> result (on cgroupv2 hierarchies) is that the process experiences more >> restrictive resource limits. Thus, there's no reason to restrict >> processes from moving to direct descendants based on whether or not they >> have cgroup.procs write access to their current cgroup. >> >> This is important for unprivileged subtree management, as it allows >> unprivileged processes to move to their newly create subtrees. > > I don't think we can do this as this allows a sub-cgroup to steal an > ancestor's process whether the ancestor likes it or not. A process > being put in a context where it's more restricted without whatever is > managing that part of cgroup hierarchy is not ok, at all. Please also > note that nobody expects its processes to be stolen underneath it. > This would be a management nightmare. I'm not sure what you mean by "steal". The user doing the migration owns the process, so I would argue that they aren't "stealing" anything. While a higher level process might not know where precisely in the hierarchy the process is, they'll know it that it must be a sub-cgroup of the one they were put in (meaning the parent can still impose restrictions without any issue). If you want, we can make it so that an unprivileged user migrating processes to a child cgroup only works if you're in the same cgroup namespace (and have CAP_SYS_ADMIN in the pinned user namespace, etc). The current setup would obviously still work, but you'd add a permission for users that just want to be able to limit their own processes. IIRC we need to update cgroup_procs_write_permission() anyway. By having the cgroup namespace requirement, you'd definitely have to "own" the process in every sense of the word I can imagine. -- Aleksa Sarai Software Engineer (Containers) SUSE Linux GmbH https://www.cyphar.com/