From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tejun Heo Subject: Re: [PATCH v5] cgroup: Add new capability to allow a process to migrate other tasks between cgroups Date: Tue, 13 Dec 2016 13:40:57 -0500 Message-ID: <20161213184057.GA17672@htj.duckdns.org> References: <1481593143-18756-1-git-send-email-john.stultz@linaro.org> Mime-Version: 1.0 Return-path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=lM4YApb587ur0tMKzmeRStayJPn5P+HaaEtcHIQ92cY=; b=J68JnlRb9UdvGPfLk2q0MOO54TVXWemt0UwK338HaA7oebWJFmyKRn9PKyHUUkt2Xg rGvAjZ8/uP0wRzUQMd2f/O7YWtA4Uhuad1RNd0nyfmBriZ98ybHtzBTTWG68lMtHDY6v wee6eZoq8NA6GUH3UhUr8MkA311fdESjGj/wXbZzPglKCTfAhWn5+SezFgdT9CQUL2HM df/x59DGqEnClelBtgQGlnJEuBnl/BY0UQIm75fmv6tAwYoxfdcFie97CB5hsk7pvugQ lJpDeOKBjl4Np5jcjFr3ZgM65nv3k8A1NZiSsjfW+YVGSQBCi5An1NVXz2EI2VSnrvVl hB0g== Content-Disposition: inline In-Reply-To: Sender: cgroups-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-ID: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: John Stultz Cc: Michael Kerrisk , lkml , Li Zefan , Jonathan Corbet , "open list:CONTROL GROUP (CGROUP)" , Android Kernel Team , Rom Lemarchand , Colin Cross , Dmitry Shmidt , Todd Kjos , Christian Poetzsch , Amit Pundir , Dmitry Torokhov , Kees Cook , "Serge E . Hallyn" , Andy Lutomirski , Linux API Hello, On Tue, Dec 13, 2016 at 08:08:16AM -0800, John Stultz wrote: > On Tue, Dec 13, 2016 at 1:47 AM, Michael Kerrisk (man-pages) > wrote: > > On 13 December 2016 at 02:39, John Stultz wrote: > > So, back to the discussion of silos. I understand the argument for > > wanting a new silo. But, in that case can we at least try not to make > > it a single-use silo? > > > > How about CAP_CGROUP_CONTROL or some such, with the idea that this > > might be a capability that allows the holder to step outside usual > > cgroup rules? At the moment, that capability would allow only one such > > step, but maybe there would be others in the future. > > This sounds reasonable to me. Tejun/Andy: Objections? Control group control? The word control has a specific meaning for cgroups and that second control doesn't make much sense to me. Given how this is mostly to patch up a hole in v1's delegation model and how migration operations are different from others, I doubt that we will end up overloading it. Maybe just CAP_CGROUP? Thanks. -- tejun From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934361AbcLMSlI (ORCPT ); Tue, 13 Dec 2016 13:41:08 -0500 Received: from mail-yb0-f193.google.com ([209.85.213.193]:35219 "EHLO mail-yb0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932250AbcLMSlE (ORCPT ); Tue, 13 Dec 2016 13:41:04 -0500 Date: Tue, 13 Dec 2016 13:40:57 -0500 From: Tejun Heo To: John Stultz Cc: Michael Kerrisk , lkml , Li Zefan , Jonathan Corbet , "open list:CONTROL GROUP (CGROUP)" , Android Kernel Team , Rom Lemarchand , Colin Cross , Dmitry Shmidt , Todd Kjos , Christian Poetzsch , Amit Pundir , Dmitry Torokhov , Kees Cook , "Serge E . Hallyn" , Andy Lutomirski , Linux API Subject: Re: [PATCH v5] cgroup: Add new capability to allow a process to migrate other tasks between cgroups Message-ID: <20161213184057.GA17672@htj.duckdns.org> References: <1481593143-18756-1-git-send-email-john.stultz@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.7.1 (2016-10-04) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hello, On Tue, Dec 13, 2016 at 08:08:16AM -0800, John Stultz wrote: > On Tue, Dec 13, 2016 at 1:47 AM, Michael Kerrisk (man-pages) > wrote: > > On 13 December 2016 at 02:39, John Stultz wrote: > > So, back to the discussion of silos. I understand the argument for > > wanting a new silo. But, in that case can we at least try not to make > > it a single-use silo? > > > > How about CAP_CGROUP_CONTROL or some such, with the idea that this > > might be a capability that allows the holder to step outside usual > > cgroup rules? At the moment, that capability would allow only one such > > step, but maybe there would be others in the future. > > This sounds reasonable to me. Tejun/Andy: Objections? Control group control? The word control has a specific meaning for cgroups and that second control doesn't make much sense to me. Given how this is mostly to patch up a hole in v1's delegation model and how migration operations are different from others, I doubt that we will end up overloading it. Maybe just CAP_CGROUP? Thanks. -- tejun