From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tejun Heo Subject: Re: Why does devices cgroup check for CAP_SYS_ADMIN explicitly? Date: Tue, 6 Nov 2012 09:41:30 -0800 Message-ID: <20121106174130.GL30069@mtj.dyndns.org> References: <20121106023845.GI19354@mtj.dyndns.org> <877gpzrlir.fsf@xmission.com> <20121106150131.GA14640@sergelap> <20121106150639.GB30069@mtj.dyndns.org> <871ug6rbio.fsf@xmission.com> <20121106154320.GE30069@mtj.dyndns.org> <87sj8mogpp.fsf@xmission.com> <20121106165246.GF30069@mtj.dyndns.org> <20121106173104.GA27990@sergelap> <20121106173823.GK30069@mtj.dyndns.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; bh=AZ5f6MMuG+YZzJKbVH4zISt9ICaaf8qFweqwqr96uY4=; b=Ue8Rmn5MNd1oBmTIvud6l4Cnq2CQ8rA2yoc3OWOmhmdDMstFX00HuiJmVbxqbjF5fs DJ2EPz8+N5ylrKRWJVPFsjtxvt2wbGI5TlE50h5L9upE2Yxcd0uGekyo0meVGLC1UxXC JOGR8Q+LoEj9o3K/S6+E6m238kA2m1zzOfAlgk7zI7QYI2ozeQDoQ6tNoUnbEPX0a0au 95sk335I1Y5X20K8scHJa1N9p3j8nABIbog+JarakVnWekGSYMlBURPqHBBEf+W40GVo vHUkU0hT/art9lI40FUWT7MuMcPxior8sFBuAHPB7Ucqf5L82sqCdtQgV7kiu+V7+8CO vjlQ== Content-Disposition: inline In-Reply-To: <20121106173823.GK30069-9pTldWuhBndy/B6EtB590w@public.gmane.org> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Serge Hallyn Cc: cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, "Eric W. Biederman" , Aristeu Rozanski Just one more thing. On Tue, Nov 06, 2012 at 09:38:23AM -0800, Tejun Heo wrote: > Hello, > > On Tue, Nov 06, 2012 at 11:31:04AM -0600, Serge Hallyn wrote: > > We can't generally require a capability to move tasks between cgroups, > > as that will break currently intended uses. I can create two cgroups, > > chown them to serge, and let serge move between them. > > Sure, then just live with the cgroupfs based permission check. What > next? Should we add CAP_SYS_RESOURCE check to all resource related > controllers? Moreover, We're headed to unified hierarchy, so in the > end that means only the user with almost all CAP_* can manipulate > cgroups at all making the whole thing meaningless. As for using cgroup as !root user, I would advise not doing that. Again, we're moving toward a unified cgroup hierarchy. You wouldn't be creating multiple cgroup hierarchies and assigning different user accesses to them. Also, I would strongly discourage chowning sub directories in cgroupfs and letting non-priviledged users modify them directly. Thanks. -- tejun