Hello, On Wed, Aug 14, 2024 at 04:09:59PM +0800, chenridong wrote: ... > Hi，TJ， We plan to use delegation in cgroup-v2, so I am conducting some > tests. > As doc mentions 'Because the resource control interface files in a given > directory control the distribution of the parent's resources, the delegatee > shouldn't be allowed to write to them.' However I found a root can write > parent's file(cgroup.subtree_control) to change the resource limits(a > fraudulent method). I believe this could pose a risk in some scenarios where > a root enters a new cgroup ns without unmounting original cgroup system, and > it can break limitations. For instance, running a docker with --privileged, > could this be a risk? > > So I sent this patch to discuss whether this case should be addressed? That sounsd like a misconfiguration. cgroup NS doesn't make much sense if you don't limit the actual visibility. The interface is half broken in that situation anyway and if you're leaking filesystem visibility into a supposedly isolated container, relaxed resource limits aren't biggest of your problems. While the proposed change isn't necessarily a bad idea, it's a behavior change and I don't either modifying existing behavior or introducing a new mount flag is justified here. Maybe just update the documentation indicating that the ancestral cgroups shouldn't be visible in a delegated ns? Thanks. -- tejun
