From mboxrd@z Thu Jan 1 00:00:00 1970 From: Aditya Kali Subject: [PATCHv3 6/8] cgroup: cgroup namespace setns support Date: Thu, 4 Dec 2014 17:55:48 -0800 Message-ID: <1417744550-6461-7-git-send-email-adityakali@google.com> References: <1417744550-6461-1-git-send-email-adityakali@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=ivtm20C71BcRBMbP9irok0pjHaIyVsK6YAvi4QkhVdI=; b=k5M1F9r5rsvLjQttyTBKguTN/OPKhPmGGNZSxN43qzh7r8TpK3WrqJS443FyX5CkaH TyRPPSmAUztrWyfjX1I8tDNd6n+3XU4AP1RHHKCthWdHB9qH4FH9/NyZDDU02UKCdc9D bRKtHSOhVbm7c9wqX/FFBfO7skguVWSs3701HJj6XNakb4jqza6Yie5ZQHwT+gk9R7Cd SVKBct5sAFhuZ79oqgTnNldug4RnqP61HijriXgvqXYxT7TvTbuMtkb6IvbfJeRKZWsX PmLcY751TNOA8CH/wAWRlSZiyHel/bC2mSrxjDCX9UzcW5pkedCyOKM4GtTJJSDinj0H 9Rmg== In-Reply-To: <1417744550-6461-1-git-send-email-adityakali-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org, lizefan-hv44wF8Li93QT0dZR+AlfA@public.gmane.org, serge.hallyn-GeWIH/nMZzLQT0dZR+AlfA@public.gmane.org, luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org, ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org, cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, mingo-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org Cc: richard.weinberger-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org, containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org setns on a cgroup namespace is allowed only if task has CAP_SYS_ADMIN in its current user-namespace and over the user-namespace associated with target cgroupns. No implicit cgroup changes happen with attaching to another cgroupns. It is expected that the somone moves the attaching process under the target cgroupns-root. Signed-off-by: Aditya Kali --- kernel/cgroup_namespace.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/kernel/cgroup_namespace.c b/kernel/cgroup_namespace.c index 0e0ef3a..ee0cc51 100644 --- a/kernel/cgroup_namespace.c +++ b/kernel/cgroup_namespace.c @@ -79,8 +79,21 @@ err_out: static int cgroupns_install(struct nsproxy *nsproxy, void *ns) { - pr_info("setns not supported for cgroup namespace"); - return -EINVAL; + struct cgroup_namespace *cgroup_ns = ns; + + if (!ns_capable(current_user_ns(), CAP_SYS_ADMIN) || + !ns_capable(cgroup_ns->user_ns, CAP_SYS_ADMIN)) + return -EPERM; + + /* Don't need to do anything if we are attaching to our own cgroupns. */ + if (cgroup_ns == nsproxy->cgroup_ns) + return 0; + + get_cgroup_ns(cgroup_ns); + put_cgroup_ns(nsproxy->cgroup_ns); + nsproxy->cgroup_ns = cgroup_ns; + + return 0; } static void *cgroupns_get(struct task_struct *task) -- 2.2.0.rc0.207.ga3a616c