Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S944561AbcJSUzs (ORCPT <rfc822;w@1wt.eu>);
        Wed, 19 Oct 2016 16:55:48 -0400
Received: from mail-yw0-f178.google.com ([209.85.161.178]:34678 "EHLO
        mail-yw0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S941852AbcJSUzq (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Wed, 19 Oct 2016 16:55:46 -0400
MIME-Version: 1.0
In-Reply-To: <20161019205251.GG3044@htj.duckdns.org>
References: <1476743724-9104-1-git-send-email-john.stultz@linaro.org>
 <CALCETrXrZpLH8NsSmaoH5ChW5+6Zb=nLsznj=x4jeWUjpQ-ecA@mail.gmail.com>
 <CALAqxLW0_Xi0vrTkTN+Gmp3yKfOcmCYYCi5f4COgPiYY=odEJA@mail.gmail.com>
 <CAKgNAkjTYu53ji=gP2qXRYpvUEdAP=gxg0BR40JJ54z+XBha-A@mail.gmail.com>
 <CALAqxLW7XS3KyA=cCKvxJAuOYhkw_d0vUJ6=RpN0a=RL2fYm=w@mail.gmail.com> <20161019205251.GG3044@htj.duckdns.org>
From: John Stultz <john.stultz@linaro.org>
Date: Wed, 19 Oct 2016 13:55:45 -0700
Message-ID: <CALAqxLUCdQseTzRnkLotCuMbuNbarQDoZfBQp-hXPW0E0HQVAw@mail.gmail.com>
Subject: Re: [PATCH] cgroup: Add new capability to allow a process to migrate
 other tasks between cgroups
To: Tejun Heo <tj@kernel.org>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>,
        Andy Lutomirski <luto@amacapital.net>,
        lkml <linux-kernel@vger.kernel.org>, Li Zefan <lizefan@huawei.com>,
        Jonathan Corbet <corbet@lwn.net>,
        "open list:CONTROL GROUP (CGROUP)" <cgroups@vger.kernel.org>,
        Android Kernel Team <kernel-team@android.com>,
        Rom Lemarchand <romlem@android.com>, Colin Cross <ccross@android.com>,
        Dmitry Shmidt <dimitrysh@google.com>, Ricky Zhou <rickyz@chromium.org>,
        Dmitry Torokhov <dmitry.torokhov@gmail.com>,
        Todd Kjos <tkjos@google.com>,
        Christian Poetzsch <christian.potzsch@imgtec.com>,
        Amit Pundir <amit.pundir@linaro.org>,
        "Serge E . Hallyn" <serge@hallyn.com>,
        Linux API <linux-api@vger.kernel.org>
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 986
Lines: 27

On Wed, Oct 19, 2016 at 1:52 PM, Tejun Heo <tj@kernel.org> wrote:
> Hello,
>
> On Tue, Oct 18, 2016 at 09:54:37AM -0700, John Stultz wrote:
>> > Also, CAP_SYS_RESOURCE deserves consideration (34 uses in capable()
>> > checks). I'd say, since cgroups are about resources, so there's
>> > something of a match there., so it's also worth considering.
>>
>> I'll try to look into CAP_SYS_RESOURCE.
>>
>> Colin/Todd: Any objection from the Android side on CAP_SYS_RESOURCE?
>>
>> (Or we could just create a new 512bit CAP2_ capabilities interface! :P)
>
> FWIW, if CAP_SYS_RESOURCE works, I'd be happy with that.

CAP_SYS_RESOURCE would work for Android right now (system_server
already has CAP_SYS_RESOURCE), so I'm optimistic this will be the best
approach (I've got a newer, much simpler patch queued for sending out
here).

But I'm waiting to hear back from folks on the Android side to make
sure they aren't planning on removing that CAP from system_server any
time soon.

thanks
-john