Re: Potential issues (security and otherwise) with the current cgroup-bpf API

From	Tejun Heo <tj@kernel.org>
Newsgroups	linux.kernel
Subject	Re: Potential issues (security and otherwise) with the current cgroup-bpf API
Date	2017-01-18 23:30 +0100
Message-ID	<t16TU-1vQ-27@gated-at.bofh.it> (permalink)
References	(5 earlier) <sVuvT-4Rn-5@gated-at.bofh.it> <t047L-1vN-5@gated-at.bofh.it> <t0BZM-7Ce-21@gated-at.bofh.it> <t0C9s-7FP-11@gated-at.bofh.it> <t0CM9-88g-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Hello, Michal.

On Tue, Jan 17, 2017 at 02:58:30PM +0100, Michal Hocko wrote:
> This would require using hierarchical cgroup iterators to iterate over

It does behave hierarchically.

> tasks. As per Andy's testing this doesn't seem to be the case. I haven't

That's not what Andy's testing showed.  What that showed was that
program in a child can override the one from its ancestor.

> checked the implementation closely but my understanding was that using
> only cgroup specific tasks was intentional.

Maybe I'm misreading you but if you're saying that a bpf program would
only execute for tasks on that specific cgroup, that is not true.

> I do agree that using hierarchy aware cgroup iterators is the right
> approach here and we wouldn't see any issue. But I am still not sure
> I've wrapped my head around this feature completely.

It's really simple.  You can install bpf programs with a cgroup path
associated with them.  When that particular type of bpf program needs
to be executed, the bpf program which is attached to the closest
ancestor (including self) is executed.

Thanks.

-- 
tejun

Thread

Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Michal Hocko <mhocko@kernel.org> - 2017-01-17 14:30 +0100
  Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Peter Zijlstra <peterz@infradead.org> - 2017-01-17 14:40 +0100
    Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Michal Hocko <mhocko@kernel.org> - 2017-01-17 15:20 +0100
      Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Andy Lutomirski <luto@amacapital.net> - 2017-01-17 21:40 +0100
      Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Tejun Heo <tj@kernel.org> - 2017-01-18 23:30 +0100
        Re: Potential issues (security and otherwise) with the current  cgroup-bpf API Michal Hocko <mhocko@kernel.org> - 2017-01-19 10:10 +0100

csiph-web