tree 83e684ad105fb91d65985b2cef05572ff72804b4
parent 1ada69c01a2518c47255257b55864acd916cdf46
author Serge Hallyn <serge.hallyn@ubuntu.com> 1449617378 -0600
committer Serge Hallyn <serge.hallyn@ubuntu.com> 1451934561 -0800

cgroup: mount cgroupns-root when inside non-init cgroupns

This patch enables cgroup mounting inside userns when a process
as appropriate privileges. The cgroup filesystem mounted is
rooted at the cgroupns-root. Thus, in a container-setup, only
the hierarchy under the cgroupns-root is exposed inside the container.
This allows container management tools to run inside the containers
without depending on any global state.

Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com>
---
Changelog:
	20151116 - Don't allow user namespaces to bind new subsystems
	20151118 - postpone the FS_USERNS_MOUNT flag until the
	           last patch, until we can convince ourselves it
		   is safe.
	20151207 - Switch to walking up the kernfs path from kn root.
		 - Group initialized variables
		 - Explain the capable(CAP_SYS_ADMIN) check
		 - Style fixes
	20160104 - kernfs_node_dentry: lock inode for lookup_one_len()

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>