Hello, On Tue, Dec 06, 2016 at 09:01:17AM -0800, Andy Lutomirski wrote: > How would one be granted the right to move processes around in one's > own subtree?
Through expicit delegation - chowning of the directory and cgroup.procs file. > Are you imagining that, if you're in /a/b and you want to move a > process that's currently in /a/b/c to /a/b/d then you're allowed to > because the target process is in your tree? If so, I doubt this has > the security properties you want -- namely, if you can cooperate with > anyone in /, even if they're unprivileged, you can break it. Delegation is an explicit operation and reflected in the ownership of the subdirectories and cgroup interface files in them. The subhierarchy containment is achieved by requiring the user who's trying to migrate a process to have write perm on cgroup.procs on the common ancestor of the source and target in addition to the target. So, a user who has a subhierarchy delegated to it can move processes around inside but not out of or into it. Also, if there are multiple delegated disjoint subhierarchies, processes can't be moved across them by the delegatee either. Thanks. -- tejun
