Re: Potential issues (security and otherwise) with the current cgroup-bpf API

From
Tejun Heo <tj@kernel.org>
Date
2017-01-18 22:20:17
Also in
linux-api, lkml
Reply to
Michal Hocko, 2017-01-17
Hello, Michal.

On Tue, Jan 17, 2017 at 02:58:30PM +0100, Michal Hocko wrote:
This would require using hierarchical cgroup iterators to iterate over
It does behave hierarchically.
tasks. As per Andy's testing this doesn't seem to be the case. I haven't
That's not what Andy's testing showed.  What that showed was that
program in a child can override the one from its ancestor.
checked the implementation closely but my understanding was that using
only cgroup specific tasks was intentional.
Maybe I'm misreading you but if you're saying that a bpf program would
only execute for tasks on that specific cgroup, that is not true.
I do agree that using hierarchy aware cgroup iterators is the right
approach here and we wouldn't see any issue. But I am still not sure
I've wrapped my head around this feature completely.
It's really simple.  You can install bpf programs with a cgroup path
associated with them.  When that particular type of bpf program needs
to be executed, the bpf program which is attached to the closest
ancestor (including self) is executed.

Thanks.

-- 
tejun
Thread (36 messages) 36 messages, 10 authors, last reply 2017-01-19
Keyboard shortcuts
hback out one level
jnext message in thread / next series-diff position
kprevious message in thread / previous series-diff position
ldrill in
Escclose help / fold thread tree
?toggle this help