[RFC PATCH 0/1] netlink: Netlink process event for cgroup migration

[RFC PATCH 0/1] netlink: Netlink process event for cgroup migration

[Prakash Sangappa]

With cgroup based resource management, it becomes useful for
userspace to be notified when a task changes cgroup membership.
Unexpected migrations can lead to incorrect resource accounting
and enforcement resulting in undesirable behavior or failures.
Applications/userspace have to poll /proc to detect changes to 
cgroup membership, which is inefficient when dealing with a large
number of tasks.

Add a new netlink proc connector event that gets generated when
a task migrates between cgroups. This allows applications/tools
to monitor cgroup membership changes without periodic polling. 

The netlink proc event will include task's pid/tgid, initiator
process pid/tgid and the cgroup id.  

Prakash Sangappa (1):
  netlink: Add Netlink process event for cgroup migration

 drivers/connector/cn_proc.c  | 28 ++++++++++++++++++++++++++++
 include/linux/cn_proc.h      |  3 +++
 include/uapi/linux/cn_proc.h | 14 ++++++++++++--
 kernel/cgroup/cgroup-v1.c    |  7 ++++++-
 kernel/cgroup/cgroup.c       |  5 ++++-
 5 files changed, 53 insertions(+), 4 deletions(-)

-- 
2.43.7

[RFC PATCH 1/1] netlink: Add Netlink process event for cgroup migration

[Prakash Sangappa]

Introduce a netlink process event that gets generated
when a task migrates between cgroup. The process event
includes the task's pid,tgid and the initiator process
pid,tgid along with the destination cgroup id.

Signed-off-by: Prakash Sangappa <prakash.sangappa@oracle.com>
---
 drivers/connector/cn_proc.c  | 28 ++++++++++++++++++++++++++++
 include/linux/cn_proc.h      |  3 +++
 include/uapi/linux/cn_proc.h | 14 ++++++++++++--
 kernel/cgroup/cgroup-v1.c    |  7 ++++++-
 kernel/cgroup/cgroup.c       |  5 ++++-
 5 files changed, 53 insertions(+), 4 deletions(-)

diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index 0056ab81fbc3..4a17572ae171 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -19,6 +19,7 @@
 
 #include <linux/cn_proc.h>
 #include <linux/local_lock.h>
+#include <linux/cgroup.h>
 
 /*
  * Size of a cn_msg followed by a proc_event structure.  Since the
@@ -355,6 +356,33 @@ void proc_exit_connector(struct task_struct *task)
 	send_msg(msg);
 }
 
+void proc_cgroup_migrate_connector(struct task_struct *task, struct cgroup *cgrp)
+{
+	struct cn_msg *msg;
+	struct proc_event *ev;
+	__u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
+
+	if (atomic_read(&proc_event_num_listeners) < 1)
+		return;
+
+	msg = buffer_to_cn_msg(buffer);
+	ev = (struct proc_event *)msg->data;
+	memset(&ev->event_data, 0, sizeof(ev->event_data));
+	ev->timestamp_ns = ktime_get_ns();
+	ev->what = PROC_EVENT_CGRP_MIGRATE;
+	ev->event_data.cgrp.process_pid = task->pid;
+	ev->event_data.cgrp.process_tgid = task->tgid;
+	ev->event_data.cgrp.initiator_pid = current->pid;
+	ev->event_data.cgrp.initiator_tgid = current->tgid;
+	ev->event_data.cgrp.cgroup_id = cgroup_id(cgrp);
+
+	memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
+	msg->ack = 0; /* not used */
+	msg->len = sizeof(*ev);
+	msg->flags = 0; /* not used */
+	send_msg(msg);
+}
+
 /*
  * Send an acknowledgement message to userspace
  *
diff --git a/include/linux/cn_proc.h b/include/linux/cn_proc.h
index 1d5b02a96c46..9b16a0456af6 100644
--- a/include/linux/cn_proc.h
+++ b/include/linux/cn_proc.h
@@ -28,6 +28,7 @@ void proc_ptrace_connector(struct task_struct *task, int which_id);
 void proc_comm_connector(struct task_struct *task);
 void proc_coredump_connector(struct task_struct *task);
 void proc_exit_connector(struct task_struct *task);
+void proc_cgroup_migrate_connector(struct task_struct *task, struct cgroup *cgrp);
 #else
 static inline void proc_fork_connector(struct task_struct *task)
 {}
@@ -54,5 +55,7 @@ static inline void proc_coredump_connector(struct task_struct *task)
 
 static inline void proc_exit_connector(struct task_struct *task)
 {}
+static inline void proc_cgrp_migrate_connector(struct task_struct *task)
+{}
 #endif	/* CONFIG_PROC_EVENTS */
 #endif	/* CN_PROC_H */
diff --git a/include/uapi/linux/cn_proc.h b/include/uapi/linux/cn_proc.h
index 18e3745b86cd..c202d7fdab28 100644
--- a/include/uapi/linux/cn_proc.h
+++ b/include/uapi/linux/cn_proc.h
@@ -33,7 +33,8 @@ enum proc_cn_mcast_op {
 #define PROC_EVENT_ALL (PROC_EVENT_FORK | PROC_EVENT_EXEC | PROC_EVENT_UID |  \
 			PROC_EVENT_GID | PROC_EVENT_SID | PROC_EVENT_PTRACE | \
 			PROC_EVENT_COMM | PROC_EVENT_NONZERO_EXIT |           \
-			PROC_EVENT_COREDUMP | PROC_EVENT_EXIT)
+			PROC_EVENT_COREDUMP | PROC_EVENT_EXIT | \
+			PROC_EVENT_CGRP_MIGRATE)
 
 /*
  * If you add an entry in proc_cn_event, make sure you add it in
@@ -51,7 +52,8 @@ enum proc_cn_event {
 	PROC_EVENT_SID  = 0x00000080,
 	PROC_EVENT_PTRACE = 0x00000100,
 	PROC_EVENT_COMM = 0x00000200,
-	/* "next" should be 0x00000400 */
+	PROC_EVENT_CGRP_MIGRATE = 0x00000400,
+	/* "next" should be 0x00000800 */
 	/* "last" is the last process event: exit,
 	 * while "next to last" is coredumping event
 	 * before that is report only if process dies
@@ -153,6 +155,14 @@ struct proc_event {
 			__kernel_pid_t parent_tgid;
 		} exit;
 
+		struct cgrp_proc_event {
+			__kernel_pid_t process_pid;
+			__kernel_pid_t process_tgid;
+			__kernel_pid_t initiator_pid;
+			__kernel_pid_t initiator_tgid;
+			__u64          cgroup_id;
+		} cgrp;
+
 	} event_data;
 };
 
diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index a4337c9b5287..9b07c9ad9b43 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -16,6 +16,8 @@
 #include <linux/pid_namespace.h>
 #include <linux/cgroupstats.h>
 #include <linux/fs_parser.h>
+#include <linux/cn_proc.h>
+
 
 #include <trace/events/cgroup.h>
 
@@ -147,8 +149,11 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from)
 
 		if (task) {
 			ret = cgroup_migrate(task, false, &mgctx);
-			if (!ret)
+			if (!ret) {
+				proc_cgroup_migrate_connector(task, to);
 				TRACE_CGROUP_PATH(transfer_tasks, to, task, false);
+			}
+
 			put_task_struct(task);
 		}
 	} while (task && !ret);
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 01fc2a93f3ef..4cac29d5c1b5 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -59,6 +59,7 @@
 #include <linux/nstree.h>
 #include <linux/irq_work.h>
 #include <net/sock.h>
+#include <linux/cn_proc.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/cgroup.h>
@@ -3040,8 +3041,10 @@ int cgroup_attach_task(struct cgroup *dst_cgrp, struct task_struct *leader,
 
 	cgroup_migrate_finish(&mgctx);
 
-	if (!ret)
+	if (!ret) {
+		proc_cgroup_migrate_connector(leader, dst_cgrp);
 		TRACE_CGROUP_PATH(attach_task, dst_cgrp, leader, threadgroup);
+	}
 
 	return ret;
 }
-- 
2.43.7

Re: [RFC PATCH 1/1] netlink: Add Netlink process event for cgroup migration

[kernel test robot]

Hi Prakash,

[This is a private test report for your RFC patch.]
kernel test robot noticed the following build errors:

[auto build test ERROR on tj-cgroup/for-next]
[also build test ERROR on net/main net-next/main linus/master v7.0 next-20260413]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Prakash-Sangappa/netlink-Add-Netlink-process-event-for-cgroup-migration/20260413-212045
base:   https://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git for-next
patch link:    https://lore.kernel.org/r/20260407172339.2017158-2-prakash.sangappa%40oracle.com
patch subject: [RFC PATCH 1/1] netlink: Add Netlink process event for cgroup migration
config: sh-allmodconfig (https://download.01.org/0day-ci/archive/20260414/202604140633.6zMiph03-lkp@intel.com/config)
compiler: sh4-linux-gcc (GCC) 15.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260414/202604140633.6zMiph03-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202604140633.6zMiph03-lkp@intel.com/

All errors (new ones prefixed by >>):

   kernel/cgroup/cgroup.c: In function 'cgroup_attach_task':
>> kernel/cgroup/cgroup.c:2985:17: error: implicit declaration of function 'proc_cgroup_migrate_connector'; did you mean 'proc_cgrp_migrate_connector'? [-Wimplicit-function-declaration]
    2985 |                 proc_cgroup_migrate_connector(leader, dst_cgrp);
         |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         |                 proc_cgrp_migrate_connector
--
   kernel/cgroup/cgroup-v1.c: In function 'cgroup_transfer_tasks':
>> kernel/cgroup/cgroup-v1.c:153:33: error: implicit declaration of function 'proc_cgroup_migrate_connector'; did you mean 'proc_cgrp_migrate_connector'? [-Wimplicit-function-declaration]
     153 |                                 proc_cgroup_migrate_connector(task, to);
         |                                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         |                                 proc_cgrp_migrate_connector


vim +2985 kernel/cgroup/cgroup.c

  2951	
  2952	/**
  2953	 * cgroup_attach_task - attach a task or a whole threadgroup to a cgroup
  2954	 * @dst_cgrp: the cgroup to attach to
  2955	 * @leader: the task or the leader of the threadgroup to be attached
  2956	 * @threadgroup: attach the whole threadgroup?
  2957	 *
  2958	 * Call holding cgroup_mutex and cgroup_threadgroup_rwsem.
  2959	 */
  2960	int cgroup_attach_task(struct cgroup *dst_cgrp, struct task_struct *leader,
  2961			       bool threadgroup)
  2962	{
  2963		DEFINE_CGROUP_MGCTX(mgctx);
  2964		struct task_struct *task;
  2965		int ret = 0;
  2966	
  2967		/* look up all src csets */
  2968		spin_lock_irq(&css_set_lock);
  2969		task = leader;
  2970		do {
  2971			cgroup_migrate_add_src(task_css_set(task), dst_cgrp, &mgctx);
  2972			if (!threadgroup)
  2973				break;
  2974		} while_each_thread(leader, task);
  2975		spin_unlock_irq(&css_set_lock);
  2976	
  2977		/* prepare dst csets and commit */
  2978		ret = cgroup_migrate_prepare_dst(&mgctx);
  2979		if (!ret)
  2980			ret = cgroup_migrate(leader, threadgroup, &mgctx);
  2981	
  2982		cgroup_migrate_finish(&mgctx);
  2983	
  2984		if (!ret) {
> 2985			proc_cgroup_migrate_connector(leader, dst_cgrp);
  2986			TRACE_CGROUP_PATH(attach_task, dst_cgrp, leader, threadgroup);
  2987		}
  2988	
  2989		return ret;
  2990	}
  2991	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [RFC PATCH 1/1] netlink: Add Netlink process event for cgroup migration

[kernel test robot]

Hi Prakash,

[This is a private test report for your RFC patch.]
kernel test robot noticed the following build errors:

[auto build test ERROR on tj-cgroup/for-next]
[also build test ERROR on net/main net-next/main linus/master v7.0 next-20260413]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Prakash-Sangappa/netlink-Add-Netlink-process-event-for-cgroup-migration/20260413-212045
base:   https://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git for-next
patch link:    https://lore.kernel.org/r/20260407172339.2017158-2-prakash.sangappa%40oracle.com
patch subject: [RFC PATCH 1/1] netlink: Add Netlink process event for cgroup migration
config: hexagon-allmodconfig (https://download.01.org/0day-ci/archive/20260414/202604141600.VBaiiHS6-lkp@intel.com/config)
compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260414/202604141600.VBaiiHS6-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202604141600.VBaiiHS6-lkp@intel.com/

All errors (new ones prefixed by >>):

>> kernel/cgroup/cgroup.c:2985:3: error: call to undeclared function 'proc_cgroup_migrate_connector'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
    2985 |                 proc_cgroup_migrate_connector(leader, dst_cgrp);
         |                 ^
   kernel/cgroup/cgroup.c:2985:3: note: did you mean 'proc_cgrp_migrate_connector'?
   include/linux/cn_proc.h:58:20: note: 'proc_cgrp_migrate_connector' declared here
      58 | static inline void proc_cgrp_migrate_connector(struct task_struct *task)
         |                    ^
   1 error generated.
--
>> kernel/cgroup/cgroup-v1.c:153:5: error: call to undeclared function 'proc_cgroup_migrate_connector'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
     153 |                                 proc_cgroup_migrate_connector(task, to);
         |                                 ^
   kernel/cgroup/cgroup-v1.c:153:5: note: did you mean 'proc_cgrp_migrate_connector'?
   include/linux/cn_proc.h:58:20: note: 'proc_cgrp_migrate_connector' declared here
      58 | static inline void proc_cgrp_migrate_connector(struct task_struct *task)
         |                    ^
   1 error generated.


vim +/proc_cgroup_migrate_connector +2985 kernel/cgroup/cgroup.c

  2951	
  2952	/**
  2953	 * cgroup_attach_task - attach a task or a whole threadgroup to a cgroup
  2954	 * @dst_cgrp: the cgroup to attach to
  2955	 * @leader: the task or the leader of the threadgroup to be attached
  2956	 * @threadgroup: attach the whole threadgroup?
  2957	 *
  2958	 * Call holding cgroup_mutex and cgroup_threadgroup_rwsem.
  2959	 */
  2960	int cgroup_attach_task(struct cgroup *dst_cgrp, struct task_struct *leader,
  2961			       bool threadgroup)
  2962	{
  2963		DEFINE_CGROUP_MGCTX(mgctx);
  2964		struct task_struct *task;
  2965		int ret = 0;
  2966	
  2967		/* look up all src csets */
  2968		spin_lock_irq(&css_set_lock);
  2969		task = leader;
  2970		do {
  2971			cgroup_migrate_add_src(task_css_set(task), dst_cgrp, &mgctx);
  2972			if (!threadgroup)
  2973				break;
  2974		} while_each_thread(leader, task);
  2975		spin_unlock_irq(&css_set_lock);
  2976	
  2977		/* prepare dst csets and commit */
  2978		ret = cgroup_migrate_prepare_dst(&mgctx);
  2979		if (!ret)
  2980			ret = cgroup_migrate(leader, threadgroup, &mgctx);
  2981	
  2982		cgroup_migrate_finish(&mgctx);
  2983	
  2984		if (!ret) {
> 2985			proc_cgroup_migrate_connector(leader, dst_cgrp);
  2986			TRACE_CGROUP_PATH(attach_task, dst_cgrp, leader, threadgroup);
  2987		}
  2988	
  2989		return ret;
  2990	}
  2991	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [RFC PATCH 0/1] netlink: Netlink process event for cgroup migration

[Michal Koutný]

[-- Attachment #1: Type: text/plain, Size: 1142 bytes --]

Hi Prakash.

On Tue, Apr 07, 2026 at 05:23:38PM +0000, Prakash Sangappa <prakash.sangappa@oracle.com> wrote:
> With cgroup based resource management, it becomes useful for
> userspace to be notified when a task changes cgroup membership.
> Unexpected migrations can lead to incorrect resource accounting
> and enforcement resulting in undesirable behavior or failures.
> Applications/userspace have to poll /proc to detect changes to 
> cgroup membership, which is inefficient when dealing with a large
> number of tasks.

You may want to check [1] (and followup discussion).

> Add a new netlink proc connector event that gets generated when
> a task migrates between cgroups. This allows applications/tools
> to monitor cgroup membership changes without periodic polling. 

This CN_IDX_PROC netlink API haunts me at night.
The hook(s) proposed above are IMO more future proof and robust approach
to the process migration that comes as a surprise (and possibly
interferes with intended resource management).

Thanks,
Michal

[1] https://lore.kernel.org/all/20260220-work-bpf-namespace-v1-2-866207db7b83@kernel.org/

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 265 bytes --]

Re: [RFC PATCH 0/1] netlink: Netlink process event for cgroup migration

[Prakash Sangappa]

Hi Michal,

Thanks for look into this patch proposal.


> On Apr 8, 2026, at 5:54 AM, Michal Koutný <mkoutny@suse.com> wrote:
> 
> Hi Prakash.
> 
> On Tue, Apr 07, 2026 at 05:23:38PM +0000, Prakash Sangappa <prakash.sangappa@oracle.com> wrote:
>> With cgroup based resource management, it becomes useful for
>> userspace to be notified when a task changes cgroup membership.
>> Unexpected migrations can lead to incorrect resource accounting
>> and enforcement resulting in undesirable behavior or failures.
>> Applications/userspace have to poll /proc to detect changes to 
>> cgroup membership, which is inefficient when dealing with a large
>> number of tasks.
> 
> You may want to check [1] (and followup discussion).

Will take a look.

> 
>> Add a new netlink proc connector event that gets generated when
>> a task migrates between cgroups. This allows applications/tools
>> to monitor cgroup membership changes without periodic polling.
> 
> This CN_IDX_PROC netlink API haunts me at night.
> The hook(s) proposed above are IMO more future proof and robust approach
> to the process migration that comes as a surprise (and possibly
> interferes with intended resource management).

Ok, with [1] would there be bpf hooks that can be used for notification
of cgroup migration events?  Will take a look.

Thanks,
-Prakash

> 
> Thanks,
> Michal
> 
> [1] https://lore.kernel.org/all/20260220-work-bpf-namespace-v1-2-866207db7b83@kernel.org/

Re: [RFC PATCH 0/1] netlink: Netlink process event for cgroup migration

[Christian Brauner]

On Wed, Apr 08, 2026 at 02:54:17PM +0200, Michal Koutný wrote:
> Hi Prakash.
> 
> On Tue, Apr 07, 2026 at 05:23:38PM +0000, Prakash Sangappa <prakash.sangappa@oracle.com> wrote:
> > With cgroup based resource management, it becomes useful for
> > userspace to be notified when a task changes cgroup membership.
> > Unexpected migrations can lead to incorrect resource accounting
> > and enforcement resulting in undesirable behavior or failures.
> > Applications/userspace have to poll /proc to detect changes to 
> > cgroup membership, which is inefficient when dealing with a large
> > number of tasks.
> 
> You may want to check [1] (and followup discussion).
> 
> > Add a new netlink proc connector event that gets generated when
> > a task migrates between cgroups. This allows applications/tools
> > to monitor cgroup membership changes without periodic polling. 
> 
> This CN_IDX_PROC netlink API haunts me at night.

Yeah, let's not go down that route...