lkml.org 
[lkml]   [2016]   [May]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v2] cgroup: allow management of subtrees by new cgroup namespaces
From
Date
> +	 * 3. cgroup core doesn't allow tasks to be migrated by users that have
> + * write access to two subtrees unless they also have write access to
> + * the common ancestor of the two subtrees. Thus you cannot use a
> + * complicit process in less restrictive cgroup to overcome your own
> + * cgroup restriction.

It appears this restriction isn't actually being applied on cgroupv1.
I'll send an updated patch which makes sure the cgroup.proc common
ancestor restriction is enforced for all hierarchies.

--
Aleksa Sarai
Software Engineer (Containers)
SUSE Linux GmbH
https://www.cyphar.com/

\
 
 \ /
  Last update: 2016-05-02 11:41    [W:0.098 / U:0.340 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site