Hello,

On Tue, Dec 13, 2016 at 08:08:16AM -0800, John Stultz wrote:

On Tue, Dec 13, 2016 at 1:47 AM, Michael Kerrisk (man-pages)
[off-list ref] wrote:

quoted

On 13 December 2016 at 02:39, John Stultz [off-list ref] wrote:
So, back to the discussion of silos. I understand the argument for
wanting a new silo. But, in that case can we at least try not to make
it a single-use silo?

How about CAP_CGROUP_CONTROL or some such, with the idea that this
might be a capability that allows the holder to step outside usual
cgroup rules? At the moment, that capability would allow only one such
step, but maybe there would be others in the future.

This sounds reasonable to me. Tejun/Andy: Objections?

Control group control?  The word control has a specific meaning for
cgroups and that second control doesn't make much sense to me.  Given
how this is mostly to patch up a hole in v1's delegation model and how
migration operations are different from others, I doubt that we will
end up overloading it.  Maybe just CAP_CGROUP?

Thanks.

-- 
tejun