summaryrefslogtreecommitdiffstats
path: root/init
diff options
context:
space:
mode:
authorTejun Heo <tj@kernel.org>2017-06-27 14:30:28 -0400
committerTejun Heo <tj@kernel.org>2017-06-28 14:45:21 -0400
commit5136f6365ce3eace5a926e10f16ed2a233db5ba9 (patch)
treedcbc7414985c212f5a9fddb6bdcac553f6014928 /init
parent824ecbe01c5d833b8c8a371c209e3ac3a76cd18a (diff)
downloadlinux-stable-5136f6365ce3eace5a926e10f16ed2a233db5ba9.tar.gz
linux-stable-5136f6365ce3eace5a926e10f16ed2a233db5ba9.tar.bz2
linux-stable-5136f6365ce3eace5a926e10f16ed2a233db5ba9.zip
cgroup: implement "nsdelegate" mount option
Currently, cgroup only supports delegation to !root users and cgroup namespaces don't get any special treatments. This limits the usefulness of cgroup namespaces as they by themselves can't be safe delegation boundaries. A process inside a cgroup can change the resource control knobs of the parent in the namespace root and may move processes in and out of the namespace if cgroups outside its namespace are visible somehow. This patch adds a new mount option "nsdelegate" which makes cgroup namespaces delegation boundaries. If set, cgroup behaves as if write permission based delegation took place at namespace boundaries - writes to the resource control knobs from the namespace root are denied and migration crossing the namespace boundary aren't allowed from inside the namespace. This allows cgroup namespace to function as a delegation boundary by itself. v2: Silently ignore nsdelegate specified on !init mounts. Signed-off-by: Tejun Heo <tj@kernel.org> Cc: Aravind Anbudurai <aru7@fb.com> Cc: Serge Hallyn <serge@hallyn.com> Cc: Eric Biederman <ebiederm@xmission.com>
Diffstat (limited to 'init')
0 files changed, 0 insertions, 0 deletions