Subject: Re: [PATCH 1/2] net: Implement SO_PEERCGROUP

From: Vivek Goyal <[email-masked]>
Date: Tue, 15 Apr 2014 20:22:45 -0400

On Tue, Apr 15, 2014 at 02:54:02PM -0700, Andy Lutomirski wrote:
> On Tue, Apr 15, 2014 at 2:15 PM, Vivek Goyal <[email-masked]> wrote:
> > Implement SO_PEERCGROUP along the lines of SO_PEERCRED. This returns the
> > cgroup of first mounted hierarchy of the task. For the case of client,
> > it represents the cgroup of client at the time of opening the connection.
> > After that client cgroup might change.
> >
> > This works only for unix stream sockets.
> 
> I still don't understand why this is useful when SCM_CGROUP exists.

I think this is more lightweight as compared to SCM_CGROUP. Information
is stored per connection as opposed to per message.

So if user space has created a system where unpriviliged processed have
been locked in cgroups and they can't escape those cgroups, then
SO_PEERCRED should be sufficient and one does not have to use SCM_CGROUP.

Thanks
Vivek