Quoting Grzegorz Nosek (root@xxxxxxxxxxxxxx): > Hi all, > > Is there a good reason for ns_can_attach to restrict moving tasks only > to direct descentants of the current cgroup? I.e. could the code: > > orig = task_cgroup(task, ns_subsys_id); > if (orig && orig != new_cgroup->parent) > return -EPERM; > > be replaced with: > > orig = task_cgroup(task, ns_subsys_id); > if (orig && !cgroup_is_descendant_of(new_cgroup, orig)) > return -EPERM; > > (for a suitable definition of cgroup_is_descendant_of). It would allow > moving tasks down the cgroup hierarchy more than one level at a time and > as far as I can see, would pose no additional problems. > > Please keep CC'd, I'm not subscribed. Well you can always move it down one level at a time, right? :) But I can't think of any reason why it would be a problem. So pls feel free to send a patch. thanks, -serge _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linux-foundation.org/mailman/listinfo/containers
