On Tue, Dec 6, 2016 at 10:12 AM, Tejun Heo <tj@xxxxxxxxxx> wrote: > Hello, > > On Tue, Dec 06, 2016 at 09:01:17AM -0800, Andy Lutomirski wrote: >> How would one be granted the right to move processes around in one's >> own subtree? > > Through expicit delegation - chowning of the directory and > cgroup.procs file. > >> Are you imagining that, if you're in /a/b and you want to move a >> process that's currently in /a/b/c to /a/b/d then you're allowed to >> because the target process is in your tree? If so, I doubt this has >> the security properties you want -- namely, if you can cooperate with >> anyone in /, even if they're unprivileged, you can break it. > > Delegation is an explicit operation and reflected in the ownership of > the subdirectories and cgroup interface files in them. The > subhierarchy containment is achieved by requiring the user who's > trying to migrate a process to have write perm on cgroup.procs on the > common ancestor of the source and target in addition to the target. OK, I see what you're doing. That's interesting. -- To unsubscribe from this list: send the line "unsubscribe cgroups" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
