Re: ns_can_attach (nsproxy cgroup)

["Serge E. Hallyn" <serue-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>]

Quoting Grzegorz Nosek (root-AfQBxy1nhrQ00sYp1HPQUA@public.gmane.org):
> Hi all,
> 
> Is there a good reason for ns_can_attach to restrict moving tasks only
> to direct descentants of the current cgroup? I.e. could the code:
> 
>         orig = task_cgroup(task, ns_subsys_id);
>         if (orig && orig != new_cgroup->parent)
>                 return -EPERM;
> 
> be replaced with:
> 
>         orig = task_cgroup(task, ns_subsys_id);
>         if (orig && !cgroup_is_descendant_of(new_cgroup, orig))
>                 return -EPERM;
> 
> (for a suitable definition of cgroup_is_descendant_of). It would allow
> moving tasks down the cgroup hierarchy more than one level at a time and
> as far as I can see, would pose no additional problems.
> 
> Please keep CC'd, I'm not subscribed.

Well you can always move it down one level at a time, right? :)

But I can't think of any reason why it would be a problem.  So
pls feel free to send a patch.

thanks,
-serge