On Tue, Nov 4, 2014 at 5:57 AM, Tejun Heo <tj@xxxxxxxxxx> wrote: > Hello, Aditya. > > On Mon, Nov 03, 2014 at 03:12:28PM -0800, Aditya Kali wrote: >> I think the sane-behavior flag is only temporary and will be removed >> anyways, right? So I didn't bother asking user to supply it. But I can >> make the change as you suggested. We just have to make sure that tasks >> inside cgroupns cannot mount non-default hierarchies as it would be a >> regression. > > I'm not sure whether supporting mounting from inside a ns is even > necessary but, if it is, can't you just test against cgrp_dfl_root? > There's no reason to do anything differnetly for ns mounting. > I am not sure I fully understand what you mean. But we don't have a way to test against cgrp_dfl_root while parsing mount-options. They only way we know that user is trying to mount a default hierarchy is via the sane_behavior flag. So I need to test against this flag it if we want to restrict processes inside cgroupns to mounting the default hierarchy only. Or are you suggesting that its OK for nsown_capable(CAP_SYS_ADMIN) processes to mount any cgroup hierarchy (irrespective of their cgroupns)? I assumed that this will be a undesirable. > Thanks. > > -- > tejun Thanks, -- Aditya _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
