Commits on Oct 22, 2021

1. specify cgroup ownership semantics …

   cgroups v2 supports secure delegation of cgroups.  Accordingly,
   control over a cgroup (that is, creation of new child cgroups and
   movement of processes and threads among the cgroup subtree exposed
   to a container) can be safely delegated to a container.  Adjusting
   the ownership enables real-world use cases like systemd-based
   containers fully isolated in user namespaces.
   
   To encourage adoption of this feature, and secure implementation,
   define the semantics of cgroup ownership.  Changing/setting the
   cgroup ownership should only be performed when:
   
   - using cgroups v2, and
   - container will have a new cgroup namespace, and
   - cgroupfs will be mounted read/write.
   
   The specific files whose ownership should be changed are listed.
   
   In terms of current practice, this is already the behaviour of crun
   (which also chown's the memory.oom.group file), and there is a pull
   request for runc: opencontainers/runc#3057.
   
   Signed-off-by: Fraser Tweedale <ftweedal@redhat.com>

   

   frasertweedale committed Oct 22, 2021
   Configuration menu

   • View commit details
   • Copy full SHA for f4ef391
   • Browse repository at this point

   Copy the full SHA

   f4ef391 View commit details

   Browse the repository at this point in the history