On Wed, Oct 19, 2016 at 1:52 PM, Tejun Heo [off-list ref] wrote:
Hello,
On Tue, Oct 18, 2016 at 09:54:37AM -0700, John Stultz wrote:
quoted
quoted
Also, CAP_SYS_RESOURCE deserves consideration (34 uses in capable()
checks). I'd say, since cgroups are about resources, so there's
something of a match there., so it's also worth considering.
I'll try to look into CAP_SYS_RESOURCE.
Colin/Todd: Any objection from the Android side on CAP_SYS_RESOURCE?
(Or we could just create a new 512bit CAP2_ capabilities interface! :P)
FWIW, if CAP_SYS_RESOURCE works, I'd be happy with that.
CAP_SYS_RESOURCE would work for Android right now (system_server
already has CAP_SYS_RESOURCE), so I'm optimistic this will be the best
approach (I've got a newer, much simpler patch queued for sending out
here).
But I'm waiting to hear back from folks on the Android side to make
sure they aren't planning on removing that CAP from system_server any
time soon.
thanks
-john