Re: [PATCH v5] cgroup: Add new capability to allow a process to migrate other tasks between cgroups

On Tue, Dec 13, 2016 at 10:40 AM, Tejun Heo [off-list ref] wrote:

Hello,

On Tue, Dec 13, 2016 at 08:08:16AM -0800, John Stultz wrote:

quoted

On Tue, Dec 13, 2016 at 1:47 AM, Michael Kerrisk (man-pages)
[off-list ref] wrote:

quoted

On 13 December 2016 at 02:39, John Stultz [off-list ref] wrote:
So, back to the discussion of silos. I understand the argument for
wanting a new silo. But, in that case can we at least try not to make
it a single-use silo?

How about CAP_CGROUP_CONTROL or some such, with the idea that this
might be a capability that allows the holder to step outside usual
cgroup rules? At the moment, that capability would allow only one such
step, but maybe there would be others in the future.

This sounds reasonable to me. Tejun/Andy: Objections?

Control group control?  The word control has a specific meaning for
cgroups and that second control doesn't make much sense to me.

But this would go against the long tradition of RAS syndrome and
things like "struct task_struct".  :)

 Given
how this is mostly to patch up a hole in v1's delegation model and how
migration operations are different from others, I doubt that we will
end up overloading it.  Maybe just CAP_CGROUP?

Sounds ok to me.

thanks
-john