Re: [RFC v3 17/22] cgroup: Add access check for cgroup_get_from_fd()

2016-09-14 Thread Mickaël Salaün
On 14/09/2016 09:24, Mickaël Salaün wrote: > Add security access check for cgroup backed FD. The "cgroup.procs" file > of the corresponding cgroup must be readable to identify the cgroup, and > writable to prove that the current process can manage this cgroup (e.g. > through delegation). This is s

[RFC v3 17/22] cgroup: Add access check for cgroup_get_from_fd()

2016-09-14 Thread Mickaël Salaün
Add security access check for cgroup backed FD. The "cgroup.procs" file of the corresponding cgroup must be readable to identify the cgroup, and writable to prove that the current process can manage this cgroup (e.g. through delegation). This is similar to the check done by cgroup_procs_write_permi