[RFC PATCH 1/2] devices cgroup: allow can_attach() if ns_capable
tj at kernel.org
Tue Jul 23 18:50:22 UTC 2013
On Tue, Jul 23, 2013 at 2:38 PM, Serge Hallyn <serge.hallyn at ubuntu.com> wrote:
> This doesn't delegate it into the container. It allows me, on the host,
> to set the cgroup for a container.
Hmmm? I'm a bit confused. Isn't the description saying that the patch
allows pseudo-root in userns to change cgroup membership even if it
isn't actually root?
Besides, I find the whole check rather bogus and would actually much
prefer just nuking the check and just follow the standard permission
More information about the Containers