Message-Id: <1475556090-6278-1-git-send-email-john.stultz@linaro.org>
Date:   Mon,  3 Oct 2016 21:41:28 -0700
From:   John Stultz <john.stultz@...aro.org>
To:     lkml <linux-kernel@...r.kernel.org>
Cc:     John Stultz <john.stultz@...aro.org>, Tejun Heo <tj@...nel.org>,
        Li Zefan <lizefan@...wei.com>,
        Jonathan Corbet <corbet@....net>, cgroups@...r.kernel.org,
        Android Kernel Team <kernel-team@...roid.com>,
        Rom Lemarchand <romlem@...roid.com>,
        Colin Cross <ccross@...roid.com>,
        Dmitry Shmidt <dimitrysh@...gle.com>,
        Todd Kjos <tkjos@...gle.com>,
        Christian Poetzsch <christian.potzsch@...tec.com>,
        Amit Pundir <amit.pundir@...aro.org>
Subject: [RFC][PATCH 0/2] Another pass at Android style loosening of cgroup attach permissions

As a heads up, this is just a first RFC and not a submission.

I wanted to send this out again, as the last time I submitted this
(https://marc.info/?l=linux-kernel&m=143217972215192&w=2) the
discussion got out into the separate issue of how Android at one
time abused memcg (but I believe now memcg is no longer used).

So for this revision, I've removed any memcg usage so we can try
to focus on just the actively used cpuset and cpuctrl cgroups.

Android currently loosens the cgroup attchment permissions, allowing
tasks with CAP_SYS_NICE to be able to allow tasks to move arbitrary
tasks across cgroups.

Android currently uses cgroups to bound tasks in various states (ie:
foreground applications, background applications, audio application,
system audio, and system tasks), to specific cpus as well as to limit
cpu time. This allows for things like audio applications to be
SCHED_FIFO but not run-away hogging infinite cpu, and background task
cpu usage to be similarly cputime limited, and kept to only low-power
cpus.

The migration of a task from the foreground to background, or to
elevate a task to audio priority, may be done by system service that
does not run as root. So this patch allows processes with CAP_SYS_NICE
to be able to migrate tasks between cgroups.  I suspect if there was a
specific cap (CAP_SYS_CHANGE_CGROUP) for this, it would be usable here,
but in its absence, they've overloaded CAP_SYS_NICE for this use.

At first glance, overloading CAP_SYS_NICE seems a bit hackish, but this
shows that there is a active and widely deployed use for different cgroup
attachment rules then what is currently available.

I've tried to rework the patches so this attachment policy is build
time configurable, and wanted to send them out for review so folks
might give their thoughts on this implementation and what they might
see as a better way to go about achieving the same goal.

Thoughts and feedback would be appriciated!

thanks
-john

Cc: Tejun Heo <tj@...nel.org>
Cc: Li Zefan <lizefan@...wei.com>
Cc: Jonathan Corbet <corbet@....net>
Cc: cgroups@...r.kernel.org
Cc: Android Kernel Team <kernel-team@...roid.com>
Cc: Rom Lemarchand <romlem@...roid.com>
Cc: Colin Cross <ccross@...roid.com>
Cc: Dmitry Shmidt <dimitrysh@...gle.com>
Cc: Todd Kjos <tkjos@...gle.com>
Cc: Christian Poetzsch <christian.potzsch@...tec.com>
Cc: Amit Pundir <amit.pundir@...aro.org>

Colin Cross (1):
  cgroup: Add generic cgroup subsystem permission checks

Rom Lemarchand (1):
  cgroup: Add a allow_attach policy for Android

 Documentation/cgroup-v1/cgroups.txt |  9 ++++++
 include/linux/cgroup-defs.h         |  1 +
 include/linux/cgroup.h              | 16 ++++++++++
 init/Kconfig                        |  7 +++++
 kernel/cgroup.c                     | 61 +++++++++++++++++++++++++++++++++++--
 kernel/cpuset.c                     |  3 ++
 kernel/sched/core.c                 |  3 ++
 7 files changed, 98 insertions(+), 2 deletions(-)

-- 
1.9.1

Powered by blists - more mailing lists