On Mon, Aug 29, 2022 at 10:49 AM Tejun Heo <tj@xxxxxxxxxx> wrote: > > On Mon, Aug 29, 2022 at 10:30:45AM -0700, Yosry Ahmed wrote: > > > I'd like to clarify, if a process A in a broad cgroup ns sets up a BPF > > > cgroup iterator, exposes it via bpffs and than a process B in a narrowed > > > cgroup ns (which excludes the origin cgroup) wants to traverse the > > > iterator, should it fail straight ahead (regardless of iter order)? > > > The alternative would be to allow self-dereference but prohibit any > > > iterator moves (regardless of order). > > > > > > > imo it should fail straight ahead, but maybe others (Tejun? Hao?) have > > other opinions here. > > Yeah, I'd prefer it to fail right away as that's simple and gives us the > most choices for the future. > Thanks Michal for fixing the cgroup iter use case! I agree that failing straight ahead is better. I don't envision a use case that wants the alternative. > Thanks. > > -- > tejun
