Re: CGroup Namespaces (v4)
From: Serge E. Hallyn <hidden>
Date: 2015-11-17 03:55:01
Also in:
cgroups, lkml
Possibly related (same subject, not in this thread)
- 2015-11-18 · Re: CGroup Namespaces (v4) · Serge E. Hallyn <hidden>
- 2015-11-18 · Re: CGroup Namespaces (v4) · Eric W. Biederman <hidden>
- 2015-11-16 · Re: CGroup Namespaces (v4) · "Serge E. Hallyn" <serge@hallyn.com>
- 2015-11-16 · Re: CGroup Namespaces (v4) · Richard Weinberger <richard@nod.at>
- 2015-11-16 · Re: CGroup Namespaces (v4) · "Serge E. Hallyn" <serge@hallyn.com>
On Mon, Nov 16, 2015 at 07:40:26PM -0600, Serge E. Hallyn wrote:
On Mon, Nov 16, 2015 at 07:13:49PM -0600, Serge E. Hallyn wrote:quoted
On Mon, Nov 16, 2015 at 04:24:27PM -0600, Eric W. Biederman wrote:
...
quoted
quoted
Similary have you considered what it required to be able to safely set FS_USERNS_MOUNT?I think the only thing we need to do is 1. go through and make sure that any ability to change mount flags is under capable() (which I have not yet done). The cgroup_mount() itself checks that flags are not changed, but there may be some subtle way to effect a change that I'm not aware of yet.At least the ability to change the clone_children and release agent through remount need to be restricted to init_user_ns root.
No, they can only be changed on a new mount, so these are fine.