Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753834AbaGQU4I (ORCPT ); Thu, 17 Jul 2014 16:56:08 -0400 Received: from mail-oa0-f41.google.com ([209.85.219.41]:54341 "EHLO mail-oa0-f41.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752010AbaGQU4F (ORCPT ); Thu, 17 Jul 2014 16:56:05 -0400 MIME-Version: 1.0 In-Reply-To: References: <1405626731-12220-1-git-send-email-adityakali@google.com> <1405626731-12220-6-git-send-email-adityakali@google.com> From: Aditya Kali Date: Thu, 17 Jul 2014 13:55:43 -0700 Message-ID: Subject: Re: [PATCH 5/5] cgroup: introduce cgroup namespaces To: Andy Lutomirski Cc: Tejun Heo , Li Zefan , cgroups@vger.kernel.org, "linux-kernel@vger.kernel.org" , Linux API , Ingo Molnar , Linux Containers Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Jul 17, 2014 at 12:57 PM, Andy Lutomirski wrote: > On Thu, Jul 17, 2014 at 12:52 PM, Aditya Kali wrote: >> Introduce the ability to create new cgroup namespace. The newly created >> cgroup namespace remembers the 'struct cgroup *root_cgrp' at the point >> of creation of the cgroup namespace. The task that creates the new >> cgroup namespace and all its future children will now be restricted only >> to the cgroup hierarchy under this root_cgrp. In the first version, >> setns() is not supported for cgroup namespaces. >> The main purpose of cgroup namespace is to virtualize the contents >> of /proc/self/cgroup file. Processes inside a cgroup namespace >> are only able to see paths relative to their namespace root. >> This allows container-tools (like libcontainer, lxc, lmctfy, etc.) >> to create completely virtualized containers without leaking system >> level cgroup hierarchy to the task. > > What happens if someone moves a task in a cgroup namespace outside of > the namespace root cgroup? > Attempt to move a task outside of cgroupns root will fail with EPERM. This is true irrespective of the privileges of the process attempting this. Once cgroupns is created, the task will be confined to the cgroup hierarchy under its cgroupns root until it dies. > --Andy -- Aditya -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/