[RFC PATCH 1/2] devices cgroup: allow can_attach() if ns_capable

Tejun Heo tj at kernel.org
Tue Jul 23 18:50:22 UTC 2013


On Tue, Jul 23, 2013 at 2:38 PM, Serge Hallyn <serge.hallyn at ubuntu.com> wrote:
> This doesn't delegate it into the container.  It allows me, on the host,
> to set the cgroup for a container.

Hmmm? I'm a bit confused. Isn't the description saying that the patch
allows pseudo-root in userns to change cgroup membership even if it
isn't actually root?

Besides, I find the whole check rather bogus and would actually much
prefer just nuking the check and just follow the standard permission
checks.

Thanks.

--
tejun


More information about the Containers mailing list