[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <d7e3fc38-24ff-4cfc-972c-82834706981f@huawei.com>
Date: Thu, 15 Aug 2024 08:50:24 +0800
From: chenridong <chenridong@...wei.com>
To: Tejun Heo <tj@...nel.org>
CC: Michal Koutný <mkoutny@...e.com>,
<lizefan.x@...edance.com>, <hannes@...xchg.org>, <longman@...hat.com>,
<cgroups@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH -next 2/2] cgroup: Disallow delegatee to write all
interfaces outsize of cgroup ns
On 2024/8/15 0:52, Tejun Heo wrote:
> Hello,
>
> On Wed, Aug 14, 2024 at 04:09:59PM +0800, chenridong wrote:
> ...
>> Hi,TJ, We plan to use delegation in cgroup-v2, so I am conducting some
>> tests.
>> As doc mentions 'Because the resource control interface files in a given
>> directory control the distribution of the parent's resources, the delegatee
>> shouldn't be allowed to write to them.' However I found a root can write
>> parent's file(cgroup.subtree_control) to change the resource limits(a
>> fraudulent method). I believe this could pose a risk in some scenarios where
>> a root enters a new cgroup ns without unmounting original cgroup system, and
>> it can break limitations. For instance, running a docker with --privileged,
>> could this be a risk?
>>
>> So I sent this patch to discuss whether this case should be addressed?
>
> That sounsd like a misconfiguration. cgroup NS doesn't make much sense if
> you don't limit the actual visibility. The interface is half broken in that
> situation anyway and if you're leaking filesystem visibility into a
> supposedly isolated container, relaxed resource limits aren't biggest of
> your problems.
>
> While the proposed change isn't necessarily a bad idea, it's a behavior
> change and I don't either modifying existing behavior or introducing a new
> mount flag is justified here. Maybe just update the documentation indicating
> that the ancestral cgroups shouldn't be visible in a delegated ns?
>
> Thanks.
>
Thank you, TJ, I will send a patch to update comment and the documentation.
Thanks,
Ridong
Powered by blists - more mailing lists