Re: [RFC] [PATCH -mm] cgroup: uid-based rules to add processes efficiently in the right cgroup

[righi.andrea@gmail.com]

On 8/18/08, Paul Menage <menage@google.com> wrote:
> On Sun, Aug 17, 2008 at 3:33 AM, Andrea Righi <righi.andrea@gmail.com>
> wrote:
>>
>> [ I wrote this patch for a "special purpose" environment, where a lot of
>> short-lived processes belonging to different users are spawned by
>> different daemons,
>
> What kinds of daemons are these? Is it not possible to add some
> libcgroup calls to these daemons?

unfortunately I don't have too much details for now, so I was just
looking for the most generic solution. The PAM lib approach seems
reasonable for each daemon that represents an entry point to the
system, and, to a large degree, I like the userspace solution (e.g.
the libcgroup as reported by Vivek). It seems to be the right way to
handle all the possible/complex rule an admin would like to define.

>
> I'm reluctant to add features like this to the kernel side of cgroups

agree

> due to their "magical" nature - any task that does a setuid() now
> risks being swept off into a different cgroup.

If the admin configures so, moving tasks that do setuid() in different
cgroups should be an expected behaviour, isn't it?

>
> Having the cgroup attachment done explicitly e.g. by a PAM library at
> login time is much less likely to cause unexpected behaviour.
>
> Maybe if we had a way to control which tasks the magical setuid
> switching occurs for, it might be more acceptable. (Perhaps base it on
> the cgroup of the task that's doing the setuid as well?

do you mean create a cgroup subsystem to handle different per-cgroup
setuid() switching behaviours?

>
> Other thoughts:
>
> - what about other uids (euid, fsuid)?
>
> - what about multiple hierarchies?
>
> - if the attach fails, userspace gets no notification.

good points.

For the last one we could just return an error code from cgroup_fork()
and  goto bad_fork_cleanup_cgroup (in this way the fork/exec would
fail anyway).

>
> Paul
>

Thanks,
-Andrea