[lxc-devel] [PATCH 8/8] Add FS_USERNS_FLAG to cgroup fs

Tejun Heo tj at kernel.org
Tue Feb 16 18:05:51 UTC 2016


On Fri, Jan 29, 2016 at 02:54:11AM -0600, serge.hallyn at ubuntu.com wrote:
> From: Serge Hallyn <serge.hallyn at ubuntu.com>
> 
> allowing root in a non-init user namespace to mount it.  This should
> now be safe, because
> 
> 1. non-init-root cannot mount a previously unbound subsystem
> 2. the task doing the mount must be privileged with respect to the
>    user namespace owning the cgroup namespace
> 3. the mounted subsystem will have its current cgroup as the root dentry.
>    the permissions will be unchanged, so tasks will receive no new
>    privilege over the cgroups which they did not have on the original
>    mounts.
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at canonical.com>

Applied 1-8 to cgroup/for-4.6-ns w/ trivial stylistic updates.

Thanks.

-- 
tejun


More information about the lxc-devel mailing list