Re: [PATCH] capabilities: add capability cgroup controller

From	Topi Miettinen <toiwoton@gmail.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH] capabilities: add capability cgroup controller
Date	2016-06-26 21:20 +0200
Message-ID	<rOnL3-6RG-7@gated-at.bofh.it> (permalink)
References	(3 earlier) <rNBwK-1xi-17@gated-at.bofh.it> <rNBGq-1Ax-9@gated-at.bofh.it> <rNCj8-22X-7@gated-at.bofh.it> <rNCCt-2dO-21@gated-at.bofh.it> <rND5v-2Dp-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 06/24/16 17:24, Tejun Heo wrote:
> Hello, Serge.
> 
> On Fri, Jun 24, 2016 at 11:59:10AM -0500, Serge E. Hallyn wrote:
>>> Just monitoring is less jarring than implementing security enforcement
>>> via cgroup, but it is still jarring.  What's wrong with recursive
>>> process hierarchy monitoring which is in line with the whole facility
>>> is implemented anyway?
>>
>> As I think Topi pointed out, one shortcoming is that if there is a short-lived
>> child task, using its /proc/self/status is racy.  You might just miss that it
>> ever even existed, let alone that the "application" needed it.
> 
> But the parent can collect whatever its children used.  We already do
> that with other stats.

The parent might be able do it if proc/pid/xyz files are still
accessible after child exit but before its exit status is collected. But
if the parent doesn't do it (and you are not able to change it to do it)
and it collects the exit status without collecting other info, can you
suggest a different way how another process could collect it 100% reliably?

-Topi

> 
> Thanks.
>

Thread

Re: [PATCH] capabilities: add capability cgroup controller Tejun Heo <tj@kernel.org> - 2016-06-23 23:40 +0200
  Re: [PATCH] capabilities: add capability cgroup controller Topi Miettinen <toiwoton@gmail.com> - 2016-06-24 02:30 +0200
    Re: [PATCH] capabilities: add capability cgroup controller Tejun Heo <tj@kernel.org> - 2016-06-24 17:50 +0200
      Re: [PATCH] capabilities: add capability cgroup controller "Serge E. Hallyn" <serge@hallyn.com> - 2016-06-24 18:00 +0200
        Re: [PATCH] capabilities: add capability cgroup controller Tejun Heo <tj@kernel.org> - 2016-06-24 18:40 +0200
          Re: [PATCH] capabilities: add capability cgroup controller "Serge E. Hallyn" <serge@hallyn.com> - 2016-06-24 19:00 +0200
            Re: [PATCH] capabilities: add capability cgroup controller Tejun Heo <tj@kernel.org> - 2016-06-24 19:30 +0200
              Re: [PATCH] capabilities: add capability cgroup controller Topi Miettinen <toiwoton@gmail.com> - 2016-06-26 21:20 +0200
                Re: [PATCH] capabilities: add capability cgroup controller Tejun Heo <tj@kernel.org> - 2016-06-27 00:30 +0200
                Re: [PATCH] capabilities: add capability cgroup controller "Serge E. Hallyn" <serge@hallyn.com> - 2016-06-27 17:00 +0200
                Re: [PATCH] capabilities: add capability cgroup controller Tejun Heo <tj@kernel.org> - 2016-06-27 21:20 +0200
                Re: [PATCH] capabilities: add capability cgroup controller "Serge E. Hallyn" <serge@hallyn.com> - 2016-06-27 21:50 +0200
                Re: [PATCH] capabilities: add capability cgroup controller Topi Miettinen <toiwoton@gmail.com> - 2016-07-03 17:10 +0200
                Re: [PATCH] capabilities: audit capability use kbuild test robot <lkp@intel.com> - 2016-07-03 18:20 +0200
                Re: [PATCH] capabilities: add capability cgroup controller Petr Mladek <pmladek@suse.com> - 2016-07-07 11:20 +0200
                Re: [PATCH] capabilities: add capability cgroup controller Topi Miettinen <toiwoton@gmail.com> - 2016-07-07 22:30 +0200
                Re: [PATCH] capabilities: add capability cgroup controller Petr Mladek <pmladek@suse.com> - 2016-07-08 11:20 +0200
                Re: [PATCH] capabilities: add capability cgroup controller Topi Miettinen <toiwoton@gmail.com> - 2016-07-09 18:40 +0200
                Re: [PATCH] capabilities: add capability cgroup controller Topi Miettinen <toiwoton@gmail.com> - 2016-06-27 21:20 +0200
            Re: [PATCH] capabilities: add capability cgroup controller ebiederm@xmission.com (Eric W. Biederman) - 2016-06-24 19:40 +0200
              Re: [PATCH] capabilities: add capability cgroup controller "Serge E. Hallyn" <serge@hallyn.com> - 2016-06-24 19:50 +0200
              Re: [PATCH] capabilities: add capability cgroup controller Topi Miettinen <toiwoton@gmail.com> - 2016-06-26 21:10 +0200
                Re: [PATCH] capabilities: add capability cgroup controller ebiederm@xmission.com (Eric W. Biederman) - 2016-06-28 07:10 +0200
                Re: [PATCH] capabilities: add capability cgroup controller Topi Miettinen <toiwoton@gmail.com> - 2016-07-02 13:30 +0200

csiph-web