Re: [RFC PATCH 1/2] devices cgroup: allow can_attach() if ns_capable

[Serge E. Hallyn]

Quoting Tejun Heo (tj@xxxxxxxxxx):
> On Tue, Jul 23, 2013 at 2:38 PM, Serge Hallyn <serge.hallyn@xxxxxxxxxx> wrote:
> > This doesn't delegate it into the container.  It allows me, on the host,
> > to set the cgroup for a container.
> 
> Hmmm? I'm a bit confused. Isn't the description saying that the patch
> allows pseudo-root in userns to change cgroup membership even if it
> isn't actually root?
> 
> Besides, I find the whole check rather bogus and would actually much
> prefer just nuking the check and just follow the standard permission
> checks.

Can we please nuke it like this then?