On Tue, Dec 6, 2016 at 10:12 AM, Tejun Heo [off-list ref] wrote:

Hello,

On Tue, Dec 06, 2016 at 09:01:17AM -0800, Andy Lutomirski wrote:

quoted

How would one be granted the right to move processes around in one's
own subtree?

Through expicit delegation - chowning of the directory and
cgroup.procs file.

quoted

Are you imagining that, if you're in /a/b and you want to move a
process that's currently in /a/b/c to /a/b/d then you're allowed to
because the target process is in your tree?  If so, I doubt this has
the security properties you want -- namely, if you can cooperate with
anyone in /, even if they're unprivileged, you can break it.

Delegation is an explicit operation and reflected in the ownership of
the subdirectories and cgroup interface files in them.  The
subhierarchy containment is achieved by requiring the user who's
trying to migrate a process to have write perm on cgroup.procs on the
common ancestor of the source and target in addition to the target.

OK, I see what you're doing.  That's interesting.