Hi all, Is there a good reason for ns_can_attach to restrict moving tasks only to direct descentants of the current cgroup? I.e. could the code: orig = task_cgroup(task, ns_subsys_id); if (orig && orig != new_cgroup->parent) return -EPERM; be replaced with: orig = task_cgroup(task, ns_subsys_id); if (orig && !cgroup_is_descendant_of(new_cgroup, orig)) return -EPERM; (for a suitable definition of cgroup_is_descendant_of). It would allow moving tasks down the cgroup hierarchy more than one level at a time and as far as I can see, would pose no additional problems. Please keep CC'd, I'm not subscribed. Best regards, Grzegorz Nosek _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linux-foundation.org/mailman/listinfo/containers