Re: [PATCH v1] cgroup,bpf: Add access check for cgroup_get_from_fd()

2016-09-20 Thread Tejun Heo
On Tue, Sep 20, 2016 at 06:53:35PM +0200, Mickaël Salaün wrote: > > On 20/09/2016 02:30, Alexei Starovoitov wrote: > > On Tue, Sep 20, 2016 at 12:49:13AM +0200, Mickaël Salaün wrote: > >> Add security access check for cgroup backed FD. The "cgroup.procs" file > >> of the corresponding cgroup shoul

Re: [PATCH v1] cgroup,bpf: Add access check for cgroup_get_from_fd()

2016-09-20 Thread Mickaël Salaün
On 20/09/2016 02:30, Alexei Starovoitov wrote: > On Tue, Sep 20, 2016 at 12:49:13AM +0200, Mickaël Salaün wrote: >> Add security access check for cgroup backed FD. The "cgroup.procs" file >> of the corresponding cgroup should be readable to identify the cgroup, >> and writable to prove that the cu

Re: [PATCH v1] cgroup,bpf: Add access check for cgroup_get_from_fd()

2016-09-20 Thread Tejun Heo
Hello, On Tue, Sep 20, 2016 at 12:49:13AM +0200, Mickaël Salaün wrote: > Add security access check for cgroup backed FD. The "cgroup.procs" file > of the corresponding cgroup should be readable to identify the cgroup, > and writable to prove that the current process can manage this cgroup > (e.g.

Re: [PATCH v1] cgroup,bpf: Add access check for cgroup_get_from_fd()

2016-09-19 Thread Alexei Starovoitov
On Tue, Sep 20, 2016 at 12:49:13AM +0200, Mickaël Salaün wrote: > Add security access check for cgroup backed FD. The "cgroup.procs" file > of the corresponding cgroup should be readable to identify the cgroup, > and writable to prove that the current process can manage this cgroup > (e.g. through