Re: [RFC][PATCH 0/2] Another pass at Android style loosening of cgroup attach permissions

[John Stultz]

On Tue, Oct 4, 2016 at 9:16 AM, Tejun Heo <tj@xxxxxxxxxx> wrote:
> On Mon, Oct 03, 2016 at 09:41:28PM -0700, John Stultz wrote:
>> The migration of a task from the foreground to background, or to
>> elevate a task to audio priority, may be done by system service that
>> does not run as root. So this patch allows processes with CAP_SYS_NICE
>> to be able to migrate tasks between cgroups.  I suspect if there was a
>> specific cap (CAP_SYS_CHANGE_CGROUP) for this, it would be usable here,
>> but in its absence, they've overloaded CAP_SYS_NICE for this use.
>
> CAP_SYS_RESOURCE won't do?

Oh, and I'll have to look into this one to see what CAP_SYS_RESOURCE
actually allows. We ran into trouble in the past changing the CAPs
required to something higher-level, which then causes trouble because
they want to avoid elevating permissions on system tasks and keep them
as restricted as possible.

thans
-john