Re: [PATCH -next 2/2] cgroup: Disallow delegatee to write all interfaces outsize of cgroup ns

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





On 2024/8/15 0:52, Tejun Heo wrote:
Hello,

On Wed, Aug 14, 2024 at 04:09:59PM +0800, chenridong wrote:
...
Hi,TJ, We plan to use delegation in cgroup-v2, so I am conducting some
tests.
As doc mentions 'Because the resource control interface files in a given
directory control the distribution of the parent's resources, the delegatee
shouldn't be allowed to write to them.' However I found a root can write
parent's file(cgroup.subtree_control) to change the resource limits(a
fraudulent method). I believe this could pose a risk in some scenarios where
a root enters a new cgroup ns without unmounting original cgroup system, and
it can break limitations. For instance, running a docker with --privileged,
could this be a risk?

So I sent this patch to discuss whether this case should be addressed?

That sounsd like a misconfiguration. cgroup NS doesn't make much sense if
you don't limit the actual visibility. The interface is half broken in that
situation anyway and if you're leaking filesystem visibility into a
supposedly isolated container, relaxed resource limits aren't biggest of
your problems.

While the proposed change isn't necessarily a bad idea, it's a behavior
change and I don't either modifying existing behavior or introducing a new
mount flag is justified here. Maybe just update the documentation indicating
that the ancestral cgroups shouldn't be visible in a delegated ns?

Thanks.


Thank you, TJ, I will send a patch to update comment and the documentation.

Thanks,
Ridong




[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux OMAP]     [Linux MIPS]     [eCos]     [Asterisk Internet PBX]     [Linux API]     [Monitors]

  Powered by Linux