Linux 5.7 To Support Spawning A Process In A Different Cgroup From Its Parent

[phoronix]

Phoronix: Linux 5.7 To Support Spawning A Process In A Different Cgroup From Its Parent

An important infrastructure change with the Linux 5.7 kernel now allows the ability to create a process in a different cgroup from the parent process...

http://www.phoronix.com/scan.php?page=news_item&px=Linux-5.7-clone3-new-cgroup

[TemplarGR]

Will this be secure?

[S.Pam]

Doesnt init/service managers already do this? I know that on OpenRC that I use all services has their own cgroup unified/v2 in /sys/fs/cgroup/<service>

[oiaohm]

Doesnt init/service managers already do this? I know that on OpenRC that I use all services has their own cgroup unified/v2 in /sys/fs/cgroup/<service>

The answer is unfortunately no. They are using a hack to generate the same results that can in fact have a race condition problem. This is finally providing a method that always works todo it.

[intelfx]

Will this be secure?

"Secure" with respect to what?

What makes you think that this could impact security in any way in the first place?

[TemplarGR]

"Secure" with respect to what?

What makes you think that this could impact security in any way in the first place?

If you don't understand that by your own, you are in no position to discuss this.

[intelfx]

If you don't understand that by your own, you are in no position to discuss this.

Public discussions don't work that way.

[skeevy420]

If you don't understand that by your own, you are in no position to discuss this.

There are no stupid questions; only stupid people.

[neeps]

Does this potentially allow e.g flatpak containers to create nested containers?

[andrei_me]

"Secure" with respect to what?

What makes you think that this could impact security in any way in the first place?

Probably in the context of escaping a sandbox/container spawning in another cgroup 🤔