On Tue, Oct 04, 2016 at 08:00:18PM -0700, John Stultz wrote: > On Tue, Oct 4, 2016 at 5:38 PM, Serge E. Hallyn <[email protected]> wrote: > > Quoting John Stultz ([email protected]): > >> So this patch, as suggested by Tejun, simply adds a new process > >> capability flag (CAP_CGROUP_MIGRATE_TASK), and uses it when checking > > > > So realistically, what all can this mean? Freezing tasks, changing > > cpu/memory limits, changing network and disk throughput, forbid forking, > > and (most importantly) forbid access to certain devices. > > > > I think that's all ok. (And we still separately check for inode write > > perms.) > > Sounds good. > > > If anything I'd say the GLOBAL_ROOT_UID check could be taken out since > > otherwise a host-root task effectively cannot drop this capability. > > Is this ok to leave for a separate patch?
Yeah. And I'm not sure whether Tejun would object to that idea. > > Acked-by: Serge Hallyn <[email protected]> > > Thanks for the review! > > Unless there's other feedback, I'll sit on this until the merge window > is over and then resubmit for consideration for 4.10. > > thanks > -john
