Quoting Aristeu Rozanski (aris@xxxxxxxxxx): > On Mon, Feb 11, 2013 at 05:42:59PM +0000, Serge E. Hallyn wrote: > > Note I said only forbid behavior changes - not exception changes - to > > cgroups with children. > > that won't do much. behavior change is the simplest: if you change a > behavior, you wipe the local exceptions unless the special (deny, deny) > -> (allow, deny) case. Right but that is what has the most non-sensical implications for propagation. > exception propagation is harder But if we removed behavior change propagation, then your exception propagation not only would be correct, it could be simplified by removing the .local stuff altogether. Local would be obvious: if it's in current and not in parent, it's local. Or when adding a new exception e2, if exception e1 is in current and not in parent minus the new exception e2, then e1 is local. > getting rid of local settings would buy more simplicity (Not sure which you mean here by 'getting rid of local settings') -serge -- To unsubscribe from this list: send the line "unsubscribe cgroups" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
