From: John Stultz <john.stultz@linaro.org> To: lkml <linux-kernel@vger.kernel.org> Cc: John Stultz <john.stultz@linaro.org>, Tejun Heo <tj@kernel.org>, Li Zefan <lizefan@huawei.com>, Jonathan Corbet <corbet@lwn.net>, cgroups@vger.kernel.org, Android Kernel Team <kernel-team@android.com>, Rom Lemarchand <romlem@android.com>, Colin Cross <ccross@android.com>, Dmitry Shmidt <dimitrysh@google.com>, Todd Kjos <tkjos@google.com>, Christian Poetzsch <christian.potzsch@imgtec.com>, Amit Pundir <amit.pundir@linaro.org> Subject: [RFC][PATCH 0/2] Another pass at Android style loosening of cgroup attach permissions Date: Mon, 3 Oct 2016 21:41:28 -0700 [thread overview] Message-ID: <1475556090-6278-1-git-send-email-john.stultz@linaro.org> (raw) As a heads up, this is just a first RFC and not a submission. I wanted to send this out again, as the last time I submitted this (https://marc.info/?l=linux-kernel&m=143217972215192&w=2) the discussion got out into the separate issue of how Android at one time abused memcg (but I believe now memcg is no longer used). So for this revision, I've removed any memcg usage so we can try to focus on just the actively used cpuset and cpuctrl cgroups. Android currently loosens the cgroup attchment permissions, allowing tasks with CAP_SYS_NICE to be able to allow tasks to move arbitrary tasks across cgroups. Android currently uses cgroups to bound tasks in various states (ie: foreground applications, background applications, audio application, system audio, and system tasks), to specific cpus as well as to limit cpu time. This allows for things like audio applications to be SCHED_FIFO but not run-away hogging infinite cpu, and background task cpu usage to be similarly cputime limited, and kept to only low-power cpus. The migration of a task from the foreground to background, or to elevate a task to audio priority, may be done by system service that does not run as root. So this patch allows processes with CAP_SYS_NICE to be able to migrate tasks between cgroups. I suspect if there was a specific cap (CAP_SYS_CHANGE_CGROUP) for this, it would be usable here, but in its absence, they've overloaded CAP_SYS_NICE for this use. At first glance, overloading CAP_SYS_NICE seems a bit hackish, but this shows that there is a active and widely deployed use for different cgroup attachment rules then what is currently available. I've tried to rework the patches so this attachment policy is build time configurable, and wanted to send them out for review so folks might give their thoughts on this implementation and what they might see as a better way to go about achieving the same goal. Thoughts and feedback would be appriciated! thanks -john Cc: Tejun Heo <tj@kernel.org> Cc: Li Zefan <lizefan@huawei.com> Cc: Jonathan Corbet <corbet@lwn.net> Cc: cgroups@vger.kernel.org Cc: Android Kernel Team <kernel-team@android.com> Cc: Rom Lemarchand <romlem@android.com> Cc: Colin Cross <ccross@android.com> Cc: Dmitry Shmidt <dimitrysh@google.com> Cc: Todd Kjos <tkjos@google.com> Cc: Christian Poetzsch <christian.potzsch@imgtec.com> Cc: Amit Pundir <amit.pundir@linaro.org> Colin Cross (1): cgroup: Add generic cgroup subsystem permission checks Rom Lemarchand (1): cgroup: Add a allow_attach policy for Android Documentation/cgroup-v1/cgroups.txt | 9 ++++++ include/linux/cgroup-defs.h | 1 + include/linux/cgroup.h | 16 ++++++++++ init/Kconfig | 7 +++++ kernel/cgroup.c | 61 +++++++++++++++++++++++++++++++++++-- kernel/cpuset.c | 3 ++ kernel/sched/core.c | 3 ++ 7 files changed, 98 insertions(+), 2 deletions(-) -- 1.9.1
WARNING: multiple messages have this Message-ID (diff)
From: John Stultz <john.stultz-QSEj5FYQhm4dnm+yROfE0A@public.gmane.org> To: lkml <linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org> Cc: John Stultz <john.stultz-QSEj5FYQhm4dnm+yROfE0A@public.gmane.org>, Tejun Heo <tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>, Li Zefan <lizefan-hv44wF8Li93QT0dZR+AlfA@public.gmane.org>, Jonathan Corbet <corbet-T1hC0tSOHrs@public.gmane.org>, cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Android Kernel Team <kernel-team-z5hGa2qSFaRBDgjK7y7TUQ@public.gmane.org>, Rom Lemarchand <romlem-z5hGa2qSFaRBDgjK7y7TUQ@public.gmane.org>, Colin Cross <ccross-z5hGa2qSFaRBDgjK7y7TUQ@public.gmane.org>, Dmitry Shmidt <dimitrysh-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>, Todd Kjos <tkjos-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>, Christian Poetzsch <christian.potzsch-1AXoQHu6uovQT0dZR+AlfA@public.gmane.org>, Amit Pundir <amit.pundir-QSEj5FYQhm4dnm+yROfE0A@public.gmane.org> Subject: [RFC][PATCH 0/2] Another pass at Android style loosening of cgroup attach permissions Date: Mon, 3 Oct 2016 21:41:28 -0700 [thread overview] Message-ID: <1475556090-6278-1-git-send-email-john.stultz@linaro.org> (raw) As a heads up, this is just a first RFC and not a submission. I wanted to send this out again, as the last time I submitted this (https://marc.info/?l=linux-kernel&m=143217972215192&w=2) the discussion got out into the separate issue of how Android at one time abused memcg (but I believe now memcg is no longer used). So for this revision, I've removed any memcg usage so we can try to focus on just the actively used cpuset and cpuctrl cgroups. Android currently loosens the cgroup attchment permissions, allowing tasks with CAP_SYS_NICE to be able to allow tasks to move arbitrary tasks across cgroups. Android currently uses cgroups to bound tasks in various states (ie: foreground applications, background applications, audio application, system audio, and system tasks), to specific cpus as well as to limit cpu time. This allows for things like audio applications to be SCHED_FIFO but not run-away hogging infinite cpu, and background task cpu usage to be similarly cputime limited, and kept to only low-power cpus. The migration of a task from the foreground to background, or to elevate a task to audio priority, may be done by system service that does not run as root. So this patch allows processes with CAP_SYS_NICE to be able to migrate tasks between cgroups. I suspect if there was a specific cap (CAP_SYS_CHANGE_CGROUP) for this, it would be usable here, but in its absence, they've overloaded CAP_SYS_NICE for this use. At first glance, overloading CAP_SYS_NICE seems a bit hackish, but this shows that there is a active and widely deployed use for different cgroup attachment rules then what is currently available. I've tried to rework the patches so this attachment policy is build time configurable, and wanted to send them out for review so folks might give their thoughts on this implementation and what they might see as a better way to go about achieving the same goal. Thoughts and feedback would be appriciated! thanks -john Cc: Tejun Heo <tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> Cc: Li Zefan <lizefan-hv44wF8Li93QT0dZR+AlfA@public.gmane.org> Cc: Jonathan Corbet <corbet-T1hC0tSOHrs@public.gmane.org> Cc: cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Cc: Android Kernel Team <kernel-team-z5hGa2qSFaRBDgjK7y7TUQ@public.gmane.org> Cc: Rom Lemarchand <romlem-z5hGa2qSFaRBDgjK7y7TUQ@public.gmane.org> Cc: Colin Cross <ccross-z5hGa2qSFaRBDgjK7y7TUQ@public.gmane.org> Cc: Dmitry Shmidt <dimitrysh-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org> Cc: Todd Kjos <tkjos-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org> Cc: Christian Poetzsch <christian.potzsch-1AXoQHu6uovQT0dZR+AlfA@public.gmane.org> Cc: Amit Pundir <amit.pundir-QSEj5FYQhm4dnm+yROfE0A@public.gmane.org> Colin Cross (1): cgroup: Add generic cgroup subsystem permission checks Rom Lemarchand (1): cgroup: Add a allow_attach policy for Android Documentation/cgroup-v1/cgroups.txt | 9 ++++++ include/linux/cgroup-defs.h | 1 + include/linux/cgroup.h | 16 ++++++++++ init/Kconfig | 7 +++++ kernel/cgroup.c | 61 +++++++++++++++++++++++++++++++++++-- kernel/cpuset.c | 3 ++ kernel/sched/core.c | 3 ++ 7 files changed, 98 insertions(+), 2 deletions(-) -- 1.9.1
next reply other threads:[~2016-10-04 4:41 UTC|newest] Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top 2016-10-04 4:41 John Stultz [this message] 2016-10-04 4:41 ` [RFC][PATCH 0/2] Another pass at Android style loosening of cgroup attach permissions John Stultz 2016-10-04 4:41 ` [PATCH 1/2] cgroup: Add generic cgroup subsystem permission checks John Stultz 2016-10-05 19:09 ` Dmitry Torokhov 2016-10-05 19:09 ` Dmitry Torokhov 2016-10-05 19:16 ` John Stultz 2016-10-05 19:16 ` John Stultz 2016-10-05 19:23 ` Dmitry Torokhov 2016-10-04 4:41 ` [PATCH 2/2] cgroup: Add a allow_attach policy for Android John Stultz 2016-10-05 19:10 ` Dmitry Torokhov 2016-10-05 19:10 ` Dmitry Torokhov 2016-10-05 19:18 ` John Stultz 2016-10-05 19:18 ` John Stultz 2016-10-06 22:43 ` Dmitry Torokhov 2016-10-06 22:43 ` Dmitry Torokhov 2016-10-06 22:52 ` Dmitry Torokhov 2016-10-04 16:16 ` [RFC][PATCH 0/2] Another pass at Android style loosening of cgroup attach permissions Tejun Heo 2016-10-04 16:16 ` Tejun Heo 2016-10-04 18:01 ` John Stultz 2016-10-04 18:01 ` John Stultz 2016-10-04 19:38 ` Tejun Heo 2016-10-04 19:38 ` Tejun Heo 2016-10-04 19:46 ` John Stultz 2016-10-04 19:46 ` John Stultz 2016-10-04 19:49 ` Tejun Heo 2016-10-04 20:18 ` Serge E. Hallyn 2016-10-04 20:18 ` Serge E. Hallyn 2016-10-04 20:33 ` Tejun Heo 2016-10-04 21:26 ` Serge E. Hallyn 2016-10-04 21:26 ` Serge E. Hallyn 2016-10-04 21:29 ` Tejun Heo 2016-10-04 18:03 ` John Stultz
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1475556090-6278-1-git-send-email-john.stultz@linaro.org \ --to=john.stultz@linaro.org \ --cc=amit.pundir@linaro.org \ --cc=ccross@android.com \ --cc=cgroups@vger.kernel.org \ --cc=christian.potzsch@imgtec.com \ --cc=corbet@lwn.net \ --cc=dimitrysh@google.com \ --cc=kernel-team@android.com \ --cc=linux-kernel@vger.kernel.org \ --cc=lizefan@huawei.com \ --cc=romlem@android.com \ --cc=tj@kernel.org \ --cc=tkjos@google.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.