kubernetes: Forbidden accessing or modifying other pod's cgroup in privileged container

What happened?

I created a privileged pod on K8S v1.24.0. Use kubectl exec to enter the pod’s shell, i noticed that the whole host cgroupfs was mount at /sys/fs/cgroup with rw mode. And i can get other pod’s cgroup, even modify it!

Created privileged pod on K8S v1.25.2, same results. Created privileged pod on K8S v1.22.0 and v1.23.0, i can only access and modify the cgroup of the current pod, which is what i expect.

BTW, my OS is ubuntu-22.04 (kernel v5.15.0) with cgroup v2. When i tested in ubuntu-18.04 (kernel v4.15.0) with cgroup v1, K8S v1.24.0/v1.25.2/v1.23.0/v1.22.0 worked as expect!

What did you expect to happen?

Forbidden accessing or modifying other pod’s cgroup in privileged pod on K8S v1.24.0 (or higher).

How can we reproduce it (as minimally and precisely as possible)?

step1. Use OS ubuntu-22.04 (or other distributions with cgroup v2) step2. Create K8S cluster v1.24.0 (or higher) by kubeadm (follow the doc kubeadm) step3. Install CNI plugin (i use calico) step4. Create a privileged pod use the below manifest, and discover its /sys/fs/cgroup

apiVersion: v1
kind: Pod
metadata:
  name: alpine
spec:
  containers:
  - image: alpine
    name: alpine
    command: ["sleep", "infinity"]
    securityContext:
      privileged: true

Anything else we need to know?

No response

Kubernetes version

$ kubectl version

Client Version: version.Info{Major:"1", Minor:"24", GitVersion:"v1.24.0", GitCommit:"4ce5a8954017644c5420bae81d72b09b735c21f0", GitTreeState:"clean", BuildDate:"2022-05-03T13:46:05Z", GoVersion:"go1.18.1", Compiler:"gc", Platform:"linux/amd64"}
Kustomize Version: v4.5.4
Server Version: version.Info{Major:"1", Minor:"24", GitVersion:"v1.24.0", GitCommit:"4ce5a8954017644c5420bae81d72b09b735c21f0", GitTreeState:"clean", BuildDate:"2022-05-03T13:38:19Z", GoVersion:"go1.18.1", Compiler:"gc", Platform:"linux/amd64"}

Cloud provider

OS version

# On Linux:
$ cat /etc/os-release
PRETTY_NAME="Ubuntu 22.04 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04 (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy

$ uname -a
Linux 18-61 5.15.0-48-generic #54-Ubuntu SMP Fri Aug 26 13:26:29 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here

Install tools

Container runtime (CRI) and version (if applicable)

containerd containerd.io 1.6.8 9cd3357b7fd7218e4aec3eae239db1f68a5a6ec6

Related plugins (CNI, CSI, …) and versions (if applicable)