From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tejun Heo Subject: Re: [PATCH 11/11] blkcg: implement per-blkg request allocation Date: Fri, 27 Apr 2012 08:51:40 -0700 Message-ID: <20120427155140.GN27486@google.com> References: <1335477561-11131-1-git-send-email-tj@kernel.org> <1335477561-11131-12-git-send-email-tj@kernel.org> <20120427150217.GK27486@google.com> <20120427154033.GJ10579@redhat.com> <20120427154502.GM27486@google.com> <20120427154841.GA16237@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; bh=kN4EGxT8dShx+J3Lw53ODb7ZZXxFmWz/yXoQMFI/8WM=; b=lS2Z1aGBijJmPUNXiitzi3bDJImPq1/bQBEbf0lvS22wvg8jXYxe/pBzdkW24de9jv 5a6bhKMSu5b5D3omCocsxqoPVmF/bDm27cRYV/yyMpluEJKcY9UDzNmH0S6GxjHb417b rpdDGrX8QTozjJrRNFCkkSdABthJi/zRZlZteikNayBsnqz8c0620VBrjW4ThTVrCAXT qKi4ZQwuwwHjJ/oV5BokMz8PhNbsqunDYgHjT+TYqsySLQebKKg7szlb3wjGajRRTanc LnWSnrVdLHO2H2ygylIb0g5w9VHsAuKrRWbLbRCBmMLPkos0Ney8Jtq0AUjt7itkE2kK gwqg== Content-Disposition: inline In-Reply-To: <20120427154841.GA16237-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Vivek Goyal Cc: axboe-tSWWG44O7X1aa/9Udqfwiw@public.gmane.org, ctalbott-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org, rni-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org, containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, hughd-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Jeff Moyer , cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org, fengguang.wu-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org On Fri, Apr 27, 2012 at 11:48:41AM -0400, Vivek Goyal wrote: > Not an unpriviliged malicious application. In typical cgroup scenario, we > can allow unpriviliged users to create child cgroups so that it can > further subdivide its resources to its children group. (ex. put firefox > in one cgroup, open office in another group etc.). > > So it is not same as jack up nr_requests. I find allowing unpriv users creating cgroups dumb. cgroup consumes kernel memory. Sans using kmemcg, what prevents them from creating gazillion cgroups and consuming all memories? The idea of allowing cgroups to !priv users is just broken from the get go. Thanks. -- tejun