> The simplest model is indeed child inheritance tree propagation - plus > perhaps the > ability for a thread to change its *own* PTI status, which obviously doesn't > create any deep "process lookup" or cross-CPU complications. > > ( Note that here I only mean "simple to implement" - we might decide to not > offer > the ABI. )
I still think cgroups are the best model for this. In particular it naturally fits things like containers, or network facing apps that fork helpers. Secondly when you are looking at barrier semantics between client/client a cgroup is much more natural as a way to group processes together who don't need to be protected from each other as they are trusting each other. (Or we could just harcode this based upon ptraceability ?) Alan
