Re: [PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-03-11 Thread Tejun Heo
On Thu, Mar 12, 2015 at 10:47:11AM +1100, Aleksa Sarai wrote: > Hi Tejun, > > > You can charge the parent's at can_attach(), remember which one you > > charged, and at post_fork() if the parent's has changed inbetween, fix > > it up. [...] > > Did you mean can_fork() instead of can_attach()

Re: [PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-03-11 Thread Aleksa Sarai
Hi Tejun, > You can charge the parent's at can_attach(), remember which one you > charged, and at post_fork() if the parent's has changed inbetween, fix > it up. [...] Did you mean can_fork() instead of can_attach() here? -- Aleksa Sarai (cyphar) www.cyphar.com -- To unsubscribe from this list:

Re: [PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-03-11 Thread Tejun Heo
On Wed, Mar 11, 2015 at 04:16:30PM +1100, Aleksa Sarai wrote: > We know that the task will have its css_set set to task_css_set(current), and > we could just use that in cgroup_can_fork(). The only question is, can > task_css_set(current) change between cgroup_can_fork() and cgroup_post_fork()?

Re: [PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-03-11 Thread Aleksa Sarai
Hi Tejun, You can charge the parent's at can_attach(), remember which one you charged, and at post_fork() if the parent's has changed inbetween, fix it up. [...] Did you mean can_fork() instead of can_attach() here? -- Aleksa Sarai (cyphar) www.cyphar.com -- To unsubscribe from this list:

Re: [PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-03-11 Thread Tejun Heo
On Wed, Mar 11, 2015 at 04:16:30PM +1100, Aleksa Sarai wrote: We know that the task will have its css_set set to task_css_set(current), and we could just use that in cgroup_can_fork(). The only question is, can task_css_set(current) change between cgroup_can_fork() and cgroup_post_fork()? Yes,

Re: [PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-03-11 Thread Tejun Heo
On Thu, Mar 12, 2015 at 10:47:11AM +1100, Aleksa Sarai wrote: Hi Tejun, You can charge the parent's at can_attach(), remember which one you charged, and at post_fork() if the parent's has changed inbetween, fix it up. [...] Did you mean can_fork() instead of can_attach() here? Ah,

Re: [PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-03-10 Thread Aleksa Sarai
Hello Tejun, On Wed, Mar 11, 2015 at 2:17 AM, Tejun Heo wrote: > On Wed, Mar 11, 2015 at 01:51:06AM +1100, Aleksa Sarai wrote: >> Actually, I'm fairly sure we can do it all inside cgroup_post_fork() because >> inside cgroup_post_fork() we have access to both the old css_set and the new >> one.

Re: [PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-03-10 Thread Tejun Heo
Hello, On Wed, Mar 11, 2015 at 01:51:06AM +1100, Aleksa Sarai wrote: > Actually, I'm fairly sure we can do it all inside cgroup_post_fork() because > inside cgroup_post_fork() we have access to both the old css_set and the new > one. Then it's just a matter of reverting and re-applying the charge

Re: [PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-03-10 Thread Aleksa Sarai
Hello Tejun, On Tue, Mar 10, 2015 at 11:47 PM, Tejun Heo wrote: >> of doing a charge that stops if you hit a certain `css` (unless we start >> passing `css_set`s to the fork/exit callbacks -- and then we can uncharge the >> old css_set and charge the new one). > > We'll have to pass the pointer

Re: [PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-03-10 Thread Tejun Heo
Hello, Aleksa. On Tue, Mar 10, 2015 at 07:19:06PM +1100, Aleksa Sarai wrote: > I'm not sure how to check for equality between two `css_set`s (or just two > `css`s). Is there a function to do so? Also, I'm not sure if there's a nice > way You can compare the css pointers for equality. > of

Re: [PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-03-10 Thread Aleksa Sarai
Hi Tejun, >> The reason is that when cgroup_can_fork() is called, the css_set doesn't >> contain the pids cgroup it's forking to. You can verify this by moving that >> segment of code back to it's original position and >> compiling/rebooting/testing >> the pids cgroup. You will get a WARN each

Re: [PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-03-10 Thread Tejun Heo
Hello, Aleksa. On Tue, Mar 10, 2015 at 07:19:06PM +1100, Aleksa Sarai wrote: I'm not sure how to check for equality between two `css_set`s (or just two `css`s). Is there a function to do so? Also, I'm not sure if there's a nice way You can compare the css pointers for equality. of doing a

Re: [PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-03-10 Thread Aleksa Sarai
Hello Tejun, On Wed, Mar 11, 2015 at 2:17 AM, Tejun Heo t...@kernel.org wrote: On Wed, Mar 11, 2015 at 01:51:06AM +1100, Aleksa Sarai wrote: Actually, I'm fairly sure we can do it all inside cgroup_post_fork() because inside cgroup_post_fork() we have access to both the old css_set and the new

Re: [PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-03-10 Thread Tejun Heo
Hello, On Wed, Mar 11, 2015 at 01:51:06AM +1100, Aleksa Sarai wrote: Actually, I'm fairly sure we can do it all inside cgroup_post_fork() because inside cgroup_post_fork() we have access to both the old css_set and the new one. Then it's just a matter of reverting and re-applying the charge to

Re: [PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-03-10 Thread Aleksa Sarai
Hello Tejun, On Tue, Mar 10, 2015 at 11:47 PM, Tejun Heo t...@kernel.org wrote: of doing a charge that stops if you hit a certain `css` (unless we start passing `css_set`s to the fork/exit callbacks -- and then we can uncharge the old css_set and charge the new one). We'll have to pass the

Re: [PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-03-10 Thread Aleksa Sarai
Hi Tejun, The reason is that when cgroup_can_fork() is called, the css_set doesn't contain the pids cgroup it's forking to. You can verify this by moving that segment of code back to it's original position and compiling/rebooting/testing the pids cgroup. You will get a WARN each time you

Re: [PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-03-08 Thread Tejun Heo
On Fri, Feb 27, 2015 at 03:17:18PM +1100, Aleksa Sarai wrote: ... > In order for can_fork to deal with a task that has an accurate css_set, > move the css_set updating to cgroup_fork (where it belongs). Hmmm? So, now the task is visible on cgroup side before the point of no return? What happens

Re: [PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-03-08 Thread Tejun Heo
On Fri, Feb 27, 2015 at 03:17:18PM +1100, Aleksa Sarai wrote: ... In order for can_fork to deal with a task that has an accurate css_set, move the css_set updating to cgroup_fork (where it belongs). Hmmm? So, now the task is visible on cgroup side before the point of no return? What happens

[PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-02-26 Thread Aleksa Sarai
Add a new cgroup subsystem callback can_fork that conditionally states whether or not the fork is accepted or rejected with a cgroup policy. Make the cgroup subsystem can_fork callback return an error code so that subsystems can accept or reject a fork from completing with a custom error value,

[PATCH v2 1/2] cgroups: allow a cgroup subsystem to reject a fork

2015-02-26 Thread Aleksa Sarai
Add a new cgroup subsystem callback can_fork that conditionally states whether or not the fork is accepted or rejected with a cgroup policy. Make the cgroup subsystem can_fork callback return an error code so that subsystems can accept or reject a fork from completing with a custom error value,