Re: [PATCH] capabilities: add capability cgroup controller

From: Serge E. Hallyn
Date: Mon Jun 27 2016 - 15:49:49 EST


Quoting Tejun Heo (tj@xxxxxxxxxx):
> Hello,
>
> On Mon, Jun 27, 2016 at 3:10 PM, Topi Miettinen <toiwoton@xxxxxxxxx> wrote:
> > I'll have to study these more. But from what I saw so far, it looks to
> > me that a separate tool would be needed to read taskstats and if that
> > tool is not taken by distros, the users would not be any wiser, right?
> > With cgroup (or /proc), no new tools would be needed.
>
> That is a factor but shouldn't be a deciding factor in designing our
> user-facing interfaces. Please also note that kernel source tree
> already has tools/ subdirectory which contains userland tools which
> are distributed along with the kernel.

And, if you take audit+cgroup approach then no tools are needed. So long
as you can have audit print out the cgroups for a task as part of the
capability audit record.