Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for direct descendants
From: Aleksa Sarai
Date: Wed Jul 20 2016 - 18:53:24 EST
If we're moving from a parent to a direct descendant, the only end
result (on cgroupv2 hierarchies) is that the process experiences more
restrictive resource limits. Thus, there's no reason to restrict
processes from moving to direct descendants based on whether or not they
have cgroup.procs write access to their current cgroup.
This is important for unprivileged subtree management, as it allows
unprivileged processes to move to their newly create subtrees.
I don't think we can do this as this allows a sub-cgroup to steal an
ancestor's process whether the ancestor likes it or not. A process
being put in a context where it's more restricted without whatever is
managing that part of cgroup hierarchy is not ok, at all. Please also
note that nobody expects its processes to be stolen underneath it.
This would be a management nightmare.
I'm not sure what you mean by "steal". The user doing the migration owns
the process, so I would argue that they aren't "stealing" anything.
While a higher level process might not know where precisely in the
hierarchy the process is, they'll know it that it must be a sub-cgroup
of the one they were put in (meaning the parent can still impose
restrictions without any issue).
If you want, we can make it so that an unprivileged user migrating
processes to a child cgroup only works if you're in the same cgroup
namespace (and have CAP_SYS_ADMIN in the pinned user namespace, etc).
The current setup would obviously still work, but you'd add a permission
for users that just want to be able to limit their own processes. IIRC
we need to update cgroup_procs_write_permission() anyway. By having the
cgroup namespace requirement, you'd definitely have to "own" the process
in every sense of the word I can imagine.
Software Engineer (Containers)
SUSE Linux GmbH