On Mon, Aug 29, 2022 at 10:30:45AM -0700, Yosry Ahmed wrote: > > I'd like to clarify, if a process A in a broad cgroup ns sets up a BPF > > cgroup iterator, exposes it via bpffs and than a process B in a narrowed > > cgroup ns (which excludes the origin cgroup) wants to traverse the > > iterator, should it fail straight ahead (regardless of iter order)? > > The alternative would be to allow self-dereference but prohibit any > > iterator moves (regardless of order). > > > > imo it should fail straight ahead, but maybe others (Tejun? Hao?) have > other opinions here. Yeah, I'd prefer it to fail right away as that's simple and gives us the most choices for the future. Thanks. -- tejun
