Re: [PATCH 1/6] cgroup: Use open-time credentials for process migraton perm checks

Linus Torvalds
2021-12-10T17:42:24Z

On Thu, Dec 9, 2021 at 1:47 PM Tejun Heo <tj@kernel.org> wrote:
>
> + saved_cred = override_creds(of->file->f_cred);
> ret = cgroup_attach_permissions(src_cgrp, dst_cgrp,
> of->file->f_path.dentry->d_sb, threadgroup);
> + revert_creds(saved_cred);

I'm not happy about adding another override_creds/revert_creds pair,
but looking at what that thing ends up doing I don't see a better
alternative - no sane way to pass in explicit creds due to the way
that "descend to common parent, use inode_permission" thing works.

So it's not pretty, and I don't love it, but I don't see a better
solution either.

Linus