On Tue, Dec 13, 2016 at 1:47 AM, Michael Kerrisk (man-pages)
[off-list ref] wrote:

On 13 December 2016 at 02:39, John Stultz [off-list ref] wrote:
So, back to the discussion of silos. I understand the argument for
wanting a new silo. But, in that case can we at least try not to make
it a single-use silo?

How about CAP_CGROUP_CONTROL or some such, with the idea that this
might be a capability that allows the holder to step outside usual
cgroup rules? At the moment, that capability would allow only one such
step, but maybe there would be others in the future.

This sounds reasonable to me. Tejun/Andy: Objections?

thanks
-john