Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758008AbYGJOw2 (ORCPT ); Thu, 10 Jul 2008 10:52:28 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1755625AbYGJOwU (ORCPT ); Thu, 10 Jul 2008 10:52:20 -0400 Received: from mx1.redhat.com ([66.187.233.31]:43146 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754934AbYGJOwT (ORCPT ); Thu, 10 Jul 2008 10:52:19 -0400 Date: Thu, 10 Jul 2008 10:48:52 -0400 From: Rik van Riel To: "Paul Menage" Cc: "Vivek Goyal" , "KAMEZAWA Hiroyuki" , "linux kernel mailing list" , "Libcg Devel Mailing List" , "Balbir Singh" , "Dhaval Giani" , "Peter Zijlstra" , "Kazunaga Ikeno" , "Morton Andrew Morton" , "Thomas Graf" Subject: Re: [RFC] How to handle the rules engine for cgroups Message-ID: <20080710104852.797fe79c@cuia.bos.redhat.com> In-Reply-To: <6599ad830807100223m2453963cwcfbe6eb1ad54d517@mail.gmail.com> References: <20080701191126.GA17376@redhat.com> <20080703101957.b3856904.kamezawa.hiroyu@jp.fujitsu.com> <20080703155446.GB9275@redhat.com> <6599ad830807100223m2453963cwcfbe6eb1ad54d517@mail.gmail.com> Organization: Red Hat, Inc X-Mailer: Claws Mail 3.4.0 (GTK+ 2.12.10; i386-redhat-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1250 Lines: 34 On Thu, 10 Jul 2008 02:23:52 -0700 "Paul Menage" wrote: > I don't see the rule-based approach being all that useful for our needs. Agreed, there really is no need for a rule-based approach in kernel space. There are basically three different cases: 1) daemons get started up in their own process groups, this can be handled by the initscripts 2) user sessions (ssh, etc) start in their own process groups, this can be handled by PAM 3) users fork processes that should go into special process groups - this could be handled by having a small ruleset in userspace handle things, right before calling exec(), it can even be hidden from the application by hooking into the exec() call If a user overrides the rules for their own processes, at worst s/he takes away resources from him/herself. No security problem. Is there any reason at all to push for a kernel side rule-based engine, except "I want to make my patch set unmergeable?" -- All Rights Reversed -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/