From: Tejun Heo <tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
To: Tony Luck <tony.luck-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
Cc: Johannes Weiner <hannes-druUgvl0LCNAfugRpC6u6w@public.gmane.org>,
cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
Ramesh Thomas
<ramesh.thomas-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
Subject: Re: Using cgroup membership for resource access control?
Date: Mon, 6 Feb 2023 11:43:53 -1000 [thread overview]
Message-ID: <Y+F0mXS9z0flDhf7@slm.duckdns.org> (raw)
In-Reply-To: <Y+F0NA9iI0zlONz7-NiLfg/pYEd1N0TnZuCh8vA@public.gmane.org>
On Mon, Feb 06, 2023 at 11:42:12AM -1000, Tejun Heo wrote:
> The flip side is that on vast majority of configurations, cgroup hierarchy
> more or less coincides with process tree which has the benefit of being
> available regardless of cgroups, so in a lot of cases, it can be better to
> just go the traditional way and tie these things to the process tree.
In case it wasn't clear - use the misc controller to restrict which cgroups
can get how many but as for sharing domain, use more traditional mechanisms
whether that's sharing through cloning, fd passing, shared path with perm
checks or whatever.
Thanks.
--
tejun
next prev parent reply other threads:[~2023-02-06 21:43 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-06 21:21 Using cgroup membership for resource access control? Tony Luck
[not found] ` <Y+FvQbfTdcTe9GVu-E6Nu+q68HHQWLgLFz2vlpa2pdiUAq4bhAL8bYrjMMd8@public.gmane.org>
2023-02-06 21:42 ` Tejun Heo
[not found] ` <Y+F0NA9iI0zlONz7-NiLfg/pYEd1N0TnZuCh8vA@public.gmane.org>
2023-02-06 21:43 ` Tejun Heo [this message]
[not found] ` <Y+F0mXS9z0flDhf7-NiLfg/pYEd1N0TnZuCh8vA@public.gmane.org>
2023-02-06 22:18 ` Luck, Tony
[not found] ` <SJ1PR11MB6083C61BCA70A31F8C0F12ECFCDA9-0NYKzF1JBnQoAmWoDslVMJPPoyLQLiKMvxpqHgZTriW3zl9H0oFU5g@public.gmane.org>
2023-02-06 23:30 ` Tejun Heo
[not found] ` <Y+GNp4VA1T9pV6nM-NiLfg/pYEd1N0TnZuCh8vA@public.gmane.org>
2023-02-07 0:48 ` Luck, Tony
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y+F0mXS9z0flDhf7@slm.duckdns.org \
--to=tj-dgejt+ai2ygdnm+yrofe0a@public.gmane.org \
--cc=cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=hannes-druUgvl0LCNAfugRpC6u6w@public.gmane.org \
--cc=ramesh.thomas-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org \
--cc=tony.luck-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox