Re: [RFC PATCH 1/2] devices cgroup: allow can_attach() if ns_capable

[Tejun Heo]

On Tue, Jul 23, 2013 at 2:38 PM, Serge Hallyn <serge.hallyn@xxxxxxxxxx> wrote:
> This doesn't delegate it into the container.  It allows me, on the host,
> to set the cgroup for a container.

Hmmm? I'm a bit confused. Isn't the description saying that the patch
allows pseudo-root in userns to change cgroup membership even if it
isn't actually root?

Besides, I find the whole check rather bogus and would actually much
prefer just nuking the check and just follow the standard permission
checks.

Thanks.

--
tejun
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/