On Tue, Oct 4, 2016 at 5:38 PM, Serge E. Hallyn <[email protected]> wrote: > Quoting John Stultz ([email protected]): >> So this patch, as suggested by Tejun, simply adds a new process >> capability flag (CAP_CGROUP_MIGRATE_TASK), and uses it when checking > > So realistically, what all can this mean? Freezing tasks, changing > cpu/memory limits, changing network and disk throughput, forbid forking, > and (most importantly) forbid access to certain devices. > > I think that's all ok. (And we still separately check for inode write > perms.)
Sounds good. > If anything I'd say the GLOBAL_ROOT_UID check could be taken out since > otherwise a host-root task effectively cannot drop this capability. Is this ok to leave for a separate patch? > Acked-by: Serge Hallyn <[email protected]> Thanks for the review! Unless there's other feedback, I'll sit on this until the merge window is over and then resubmit for consideration for 4.10. thanks -john
