On Tue, Oct 4, 2016 at 9:16 AM, Tejun Heo <tj@xxxxxxxxxx> wrote: > On Mon, Oct 03, 2016 at 09:41:28PM -0700, John Stultz wrote: >> The migration of a task from the foreground to background, or to >> elevate a task to audio priority, may be done by system service that >> does not run as root. So this patch allows processes with CAP_SYS_NICE >> to be able to migrate tasks between cgroups. I suspect if there was a >> specific cap (CAP_SYS_CHANGE_CGROUP) for this, it would be usable here, >> but in its absence, they've overloaded CAP_SYS_NICE for this use. > > CAP_SYS_RESOURCE won't do? Oh, and I'll have to look into this one to see what CAP_SYS_RESOURCE actually allows. We ran into trouble in the past changing the CAPs required to something higher-level, which then causes trouble because they want to avoid elevating permissions on system tasks and keep them as restricted as possible. thans -john -- To unsubscribe from this list: send the line "unsubscribe cgroups" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
