All of lore.kernel.org
 help / color / mirror / Atom feed
From: Serge Hallyn <serge.hallyn-GeWIH/nMZzLQT0dZR+AlfA@public.gmane.org>
To: Tejun Heo <tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
Cc: containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org,
	ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org,
	linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Subject: Re: [RFC PATCH 1/2] devices cgroup: allow can_attach() if ns_capable
Date: Tue, 23 Jul 2013 13:38:41 -0500	[thread overview]
Message-ID: <20130723183841.GA9021@tp> (raw)
In-Reply-To: <20130723183018.GF21100-9pTldWuhBndy/B6EtB590w@public.gmane.org>

Quoting Tejun Heo (tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org):
> On Tue, Jul 23, 2013 at 01:16:06PM -0500, Serge Hallyn wrote:
> > We allow a task to change its own devices cgroup, or to change other tasks'
> > cgroups if it has CAP_SYS_ADMIN.
> > 
> > Also allow task A to change task B's cgroup if task A has CAP_SYS_ADMIN
> > with respect to task B - meaning A is root in the same userns, or A
> > created B's userns.
> 
> As discussed multpile times, cgroup isn't gonna support delegating
> cgroup management directly into containers, so this doesn't really
> jive with where we're heading.

This doesn't delegate it into the container.  It allows me, on the host,
to set the cgroup for a container.

thanks,
-serge

WARNING: multiple messages have this Message-ID (diff)
From: Serge Hallyn <serge.hallyn@ubuntu.com>
To: Tejun Heo <tj@kernel.org>
Cc: ebiederm@xmission.com, linux-kernel@vger.kernel.org,
	containers@lists.linux-foundation.org
Subject: Re: [RFC PATCH 1/2] devices cgroup: allow can_attach() if ns_capable
Date: Tue, 23 Jul 2013 13:38:41 -0500	[thread overview]
Message-ID: <20130723183841.GA9021@tp> (raw)
In-Reply-To: <20130723183018.GF21100@mtj.dyndns.org>

Quoting Tejun Heo (tj@kernel.org):
> On Tue, Jul 23, 2013 at 01:16:06PM -0500, Serge Hallyn wrote:
> > We allow a task to change its own devices cgroup, or to change other tasks'
> > cgroups if it has CAP_SYS_ADMIN.
> > 
> > Also allow task A to change task B's cgroup if task A has CAP_SYS_ADMIN
> > with respect to task B - meaning A is root in the same userns, or A
> > created B's userns.
> 
> As discussed multpile times, cgroup isn't gonna support delegating
> cgroup management directly into containers, so this doesn't really
> jive with where we're heading.

This doesn't delegate it into the container.  It allows me, on the host,
to set the cgroup for a container.

thanks,
-serge

  parent reply	other threads:[~2013-07-23 18:38 UTC|newest]

Thread overview: 28+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-07-23 18:16 [RFC PATCH 1/2] devices cgroup: allow can_attach() if ns_capable Serge Hallyn
2013-07-23 18:16 ` Serge Hallyn
2013-07-23 18:18 ` [RFC PATCH 2/2] capabilities: allow nice if we are privileged Serge Hallyn
2013-07-23 18:18   ` Serge Hallyn
2013-07-24  8:07   ` Eric W. Biederman
2013-07-24  8:07     ` Eric W. Biederman
2013-07-23 18:30 ` [RFC PATCH 1/2] devices cgroup: allow can_attach() if ns_capable Tejun Heo
2013-07-23 18:30   ` Tejun Heo
     [not found]   ` <20130723183018.GF21100-9pTldWuhBndy/B6EtB590w@public.gmane.org>
2013-07-23 18:38     ` Serge Hallyn [this message]
2013-07-23 18:38       ` Serge Hallyn
2013-07-23 18:50       ` Tejun Heo
2013-07-23 18:50         ` Tejun Heo
     [not found]         ` <CAOS58YPynQ-QBx5nZEnYrP5kGTVvv9VAj0cV0aYeikTitvTQbA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2013-07-23 19:04           ` Serge Hallyn
2013-07-23 19:04             ` Serge Hallyn
2013-07-23 19:12             ` Tejun Heo
2013-07-23 19:12               ` Tejun Heo
     [not found]               ` <20130723191245.GI21100-9pTldWuhBndy/B6EtB590w@public.gmane.org>
2013-07-23 19:28                 ` Serge Hallyn
2013-07-23 19:28                   ` Serge Hallyn
2013-07-23 19:39                   ` Tejun Heo
2013-07-23 19:39                     ` Tejun Heo
     [not found]                     ` <CAOS58YPEKtEiZWsn-8u6OPr-UsyQp=XR+ecGmXyOdT0JnYAmsA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2013-11-04 21:51                       ` Serge E. Hallyn
2013-11-04 21:51                         ` Serge E. Hallyn
     [not found]                         ` <20131104215135.GA26190-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org>
2013-11-04 22:06                           ` Tejun Heo
2013-11-04 22:06                             ` Tejun Heo
2013-10-23  0:41           ` Serge E. Hallyn
2013-10-23  0:41             ` Serge E. Hallyn
     [not found]             ` <20131023004130.GA12788-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org>
2013-10-24 10:57               ` Tejun Heo
2013-10-24 10:57                 ` Tejun Heo

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20130723183841.GA9021@tp \
    --to=serge.hallyn-gewih/nmzzlqt0dzr+alfa@public.gmane.org \
    --cc=containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org \
    --cc=ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org \
    --cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.