# Re: \[RESEND\]\[PATCH v4\] cgroup: Use CAP\_SYS\_RESOURCE to allow a process to migrate other tasks between cgroups

- From: Andy Lutomirski \<luto@amacapital.net\>
- Date: 2016-12-06 18:15:06 
- List: linux-api
- Page: https://ratatoskr.run/linux-api/2016/12/4890218
- Thread: https://ratatoskr.run/netdev/2016/11/4870472/t.md

```text
On Tue, Dec 6, 2016 at 10:12 AM, Tejun Heo [ref] wrote:
> Hello,
>
> On Tue, Dec 06, 2016 at 09:01:17AM -0800, Andy Lutomirski wrote:
>> How would one be granted the right to move processes around in one's
>> own subtree?
>
> Through expicit delegation - chowning of the directory and
> cgroup.procs file.
>
>> Are you imagining that, if you're in /a/b and you want to move a
>> process that's currently in /a/b/c to /a/b/d then you're allowed to
>> because the target process is in your tree?  If so, I doubt this has
>> the security properties you want -- namely, if you can cooperate with
>> anyone in /, even if they're unprivileged, you can break it.
>
> Delegation is an explicit operation and reflected in the ownership of
> the subdirectories and cgroup interface files in them.  The
> subhierarchy containment is achieved by requiring the user who's
> trying to migrate a process to have write perm on cgroup.procs on the
> common ancestor of the source and target in addition to the target.

OK, I see what you're doing.  That's interesting.
```