To allow write access to top-level cgroup e.g. on CT start and resume one need to enable ve.pseudosuper, appropriate patch sent to libvzctl.
libvzctl pull request: https://src.openvz.org/projects/OVZ/repos/libvzctl/pull-requests/50/ https://jira.sw.ru/browse/PSBM-44981 Signed-off-by: Pavel Tikhomirov <[email protected]> --- kernel/cgroup.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/kernel/cgroup.c b/kernel/cgroup.c index 3bc12e4..fa4eeb5 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -2411,10 +2411,10 @@ static ssize_t cgroup_file_write(struct file *file, const char __user *buf, * userspace from ve0 should *never* bindmount it * inside a container FS. */ - if (!ve_is_super(get_exec_env())) { - if (!cgrp->parent || !cgrp->parent->parent) - pr_warn_once("FIXME: Write into toplevel cgroup, restore?"); - } + if (!ve_is_super(get_exec_env()) + && (!cgrp->parent || !cgrp->parent->parent) + && !get_exec_env()->is_pseudosuper) + return -EPERM; #endif if (cgroup_is_removed(cgrp)) -- 1.9.3 _______________________________________________ Devel mailing list [email protected] https://lists.openvz.org/mailman/listinfo/devel
