Re: [RFC] [PATCH -mm] cgroup: uid-based rules to add processes efficiently in the right cgroup

[David Collier-Brown <davecb@sun.com>]

Vivek Goyal wrote:
> Who executes default rules? IOW, how do you make sure tasks of user.davecb
> end up in project 101 only and not outside?

A classifier at login/connect starts each new process off in the correct group.
New processes inherit their parent's group unless you use newtask or su.

> So by default all the tasks of user.davecb will run into project 101 until
> user davecb decides to launch some background jobs in project 100 using
> newtask?

That's right, the and cgexec-like "newtask" is what I use
to script things: for example, my background script says

       case "$1" in
        [0-9]*) # It's a pid
                newtask -p bg -c $1
                ;;
        *) # It's a command-line
                newtask -p bg "$@" &
                ;;
        esac

There's also an -F option to put a process into a cgroup
and never let it newtask itself or it's children to another one,
so that software from Dr Evil, Inc. can't do privilege 
escalation (;-))

--dave
-- 
David Collier-Brown            | Always do right. This will gratify
Sun Microsystems, Toronto      | some people and astonish the rest
davecb@sun.com                 |                      -- Mark Twain
cell: (647) 833-9377, bridge: (877) 385-4099 code: 506 9191#