On Tue, Oct 4, 2016 at 5:38 PM, Serge E. Hallyn <serge@xxxxxxxxxx> wrote: > Quoting John Stultz (john.stultz@xxxxxxxxxx): >> So this patch, as suggested by Tejun, simply adds a new process >> capability flag (CAP_CGROUP_MIGRATE_TASK), and uses it when checking > > So realistically, what all can this mean? Freezing tasks, changing > cpu/memory limits, changing network and disk throughput, forbid forking, > and (most importantly) forbid access to certain devices. > > I think that's all ok. (And we still separately check for inode write > perms.) Sounds good. > If anything I'd say the GLOBAL_ROOT_UID check could be taken out since > otherwise a host-root task effectively cannot drop this capability. Is this ok to leave for a separate patch? > Acked-by: Serge Hallyn <serge@xxxxxxxxxx> Thanks for the review! Unless there's other feedback, I'll sit on this until the merge window is over and then resubmit for consideration for 4.10. thanks -john -- To unsubscribe from this list: send the line "unsubscribe cgroups" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
