From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753237AbcGVIY4 (ORCPT ); Fri, 22 Jul 2016 04:24:56 -0400 Received: from mx2.suse.de ([195.135.220.15]:60632 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751482AbcGVIYw (ORCPT ); Fri, 22 Jul 2016 04:24:52 -0400 Subject: Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for direct descendants To: Tejun Heo , James Bottomley References: <20160720230228.GA19588@mtj.duckdns.org> <982fcf3a-3685-9bd7-dd95-7bff255c9421@suse.de> <20160720231949.GB19588@mtj.duckdns.org> <379e5b13-29d4-ca75-1935-0a64f3db8d27@suse.de> <20160721145242.GB22680@htj.duckdns.org> <1469113456.2331.16.camel@HansenPartnership.com> <20160721150740.GF22680@htj.duckdns.org> <1469114194.2331.20.camel@HansenPartnership.com> <20160721152648.GA23759@htj.duckdns.org> <1469115276.2331.23.camel@HansenPartnership.com> <20160721155046.GB23759@htj.duckdns.org> Cc: Greg Kroah-Hartman , Li Zefan , Johannes Weiner , "Serge E. Hallyn" , Aditya Kali , Chris Wilson , linux-kernel@vger.kernel.org, cgroups@vger.kernel.org, Christian Brauner , dev@opencontainers.org From: Aleksa Sarai Message-ID: <177bbc17-5c75-1ff8-0b1f-0c5601fa7e6b@suse.de> Date: Fri, 22 Jul 2016 18:30:07 +1000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 In-Reply-To: <20160721155046.GB23759@htj.duckdns.org> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org >> So if I as the cgroup ns owner am moving a task from A to A_subdir, the >> admin scanning tasks in all of A may miss this task in motion because >> all the tasks files can't be scanned atomically? > > So, the admin just wants to move processes from A and only A to B. It > doesn't wanna interfere with processes in the subdirs or on-going ns > operations, but if the race occurs, both A -> B migration and ns > subdir operation would succeed and the end result would be something > neither expects. Just to be clear, the "ns subdir operation" is a cgroup namespaced process moving A -> A_subdir which is racing against some administrative process moving everything from A -> B (but not wanting to move A -> A_subdir)? So should there be policy within the kernel to not permit a process outside a cgroup namespace to move processes inside the namespace? Or would you be concerned about people escaping the administrator's attempts to reorganise the hierarchy? What if we extended rename(2) so that it /does/ allow for reorganisation of the hierarchy? So an administrator could use rename to change the point at which a cgroupns root is rooted at, but not be able to move the actual processes within the cgroup namespace around? The administrator could also join the cgroupns (without needing to join the userns) and then just move things around that way? Do any of those suggestions seem reasonable? -- Aleksa Sarai Software Engineer (Containers) SUSE Linux GmbH https://www.cyphar.com/