Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <a4912516-8c6b-d8d3-b714-5c03bcfc5e91@gmail.com> <20181017161958.GT270328@devbig004.ftw2.facebook.com>
In-Reply-To: <20181017161958.GT270328@devbig004.ftw2.facebook.com>
Reply-To: mtk.manpages@gmail.com
From:   "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com>
Date:   Tue, 23 Oct 2018 18:09:05 +0200
Message-ID: <CAKgNAkgEeHSYCFGdXOBQHBALg0KgWP_1=dEFYD_R6wCaV99MJg@mail.gmail.com>
Subject: Re: Cgroup v2 thread mode oddity: "domain invalid" cgroup with
 threaded controller enabled
To:     Tejun Heo <tj@kernel.org>
Cc:     "open list:CONTROL GROUP (CGROUP)" <cgroups@vger.kernel.org>,
        "Serge E. Hallyn" <serge@hallyn.com>,
        lkml <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hi Tejun
On Wed, 17 Oct 2018 at 18:20, Tejun Heo <tj@kernel.org> wrote:
>
> Hello, Michael.
>
> Sorry about the delay.
>
> On Thu, Oct 04, 2018 at 09:40:57PM +0200, Michael Kerrisk (man-pages) wrote:
> > This seems odd. x/y is now of "domain invalid" type with a controller
> > enabled! This feels like a violation of the rules, since we can't
> > in other circumstances do anything with a "domain invalid" cgroup
> > except convert it to "threaded". In particular, we can't create
> > child cgroups under a "domain invalid" cgroup, or add member processes
> > to the cgroup, or *enable controllers in the cgroup*. In fact, when
> > doing the
> >
> >     # echo threaded > x/z/cgroup.type
> >
> > I had expected a write(2) error because the state of x/y should
> > (I thought) not be permitted.
>
> So, both the interim (before turning x/z into threaded) and final
> (after) are completely fine - the cgroups are empty and whether
> threaded controllers like pids are enabled or not don't really change
> things that much.
>
> Maybe it is a bit inconsistent to then deny enabling threaded
> controllers on invalid domain cgroups.  We can lift that restriction
> but I personally can't see why that'd be clearly better.

So, I also can't see anything that seems harmful in the scenario I
described; it's just an odd inconsistency, and I supposed it was
unintended/overlooked behavior, and I wanted to alert you to it, in
case it seemed problematic. However, as long as you have no concerns,
I see no reason to change the existing behavior.

Thanks,

Michael

-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/