From mboxrd@z Thu Jan  1 00:00:00 1970
From: Tejun Heo <tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
Subject: Re: Why does devices cgroup check for CAP_SYS_ADMIN explicitly?
Date: Tue, 6 Nov 2012 09:38:23 -0800
Message-ID: <20121106173823.GK30069@mtj.dyndns.org>
References: <20121106023845.GI19354@mtj.dyndns.org>
 <877gpzrlir.fsf@xmission.com>
 <20121106150131.GA14640@sergelap>
 <20121106150639.GB30069@mtj.dyndns.org>
 <871ug6rbio.fsf@xmission.com>
 <20121106154320.GE30069@mtj.dyndns.org>
 <87sj8mogpp.fsf@xmission.com>
 <20121106165246.GF30069@mtj.dyndns.org>
 <20121106173104.GA27990@sergelap>
Mime-Version: 1.0
Return-path: <cgroups-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=sender:date:from:to:cc:subject:message-id:references:mime-version
         :content-type:content-disposition:in-reply-to:user-agent;
        bh=38+bCOmM2cUHQQ7S4/4DQEhG9y3rFlJIf3vPsn1BHBA=;
        b=t176IC3skhCUv09cTqughBQLeLmIW1kNhH7wt6fVrozwn2rCFyI0Vn4hsil5Fypn0J
         Bn/WOOrjeEGtgDHHRR+sntSIRvESPveKQMaoM1DE2lyTuPeTnfOpgRJ1OiwkyECbBHGc
         sRM2Zxqcyn85yQVKv2QIrg0OeJjyRTRvWorA813JpUAbdRl6MDIve9zG7Q9wwJhFN064
         xkpBvnhjURQT0UHau9xkSE1N6KpeZSKh/0pPxMSvPctbf+zVeFFNq4vC1Lx/nDWmuYCM
         +VTfMxrWAD+zIH1o51FQuERyNA3xvUv/ya/faW+MiiL8xv+cKlVyewA6riqOfUB6TQIq
         pgjA==
Content-Disposition: inline
In-Reply-To: <20121106173104.GA27990@sergelap>
Sender: cgroups-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
List-ID: <cgroups.vger.kernel.org>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
To: Serge Hallyn <serge.hallyn-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
Cc: "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>, Aristeu Rozanski <aris-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>, cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org

Hello,

On Tue, Nov 06, 2012 at 11:31:04AM -0600, Serge Hallyn wrote:
> We can't generally require a capability to move tasks between cgroups,
> as that will break currently intended uses.  I can create two cgroups,
> chown them to serge, and let serge move between them.

Sure, then just live with the cgroupfs based permission check.  What
next?  Should we add CAP_SYS_RESOURCE check to all resource related
controllers?  Moreover, We're headed to unified hierarchy, so in the
end that means only the user with almost all CAP_* can manipulate
cgroups at all making the whole thing meaningless.

I don't think applying fine-grained CAP_* to cgroup controllers makes
sense or would be useful in any real sense.  We can introduce, say,
CAP_CGROUP to control access cgroupfs but I think we already have
enough access control to cgroupfs, don't we?

Thanks.

-- 
tejun