Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 858d72ea authored by Serge E. Hallyn's avatar Serge E. Hallyn Committed by Linus Torvalds
Browse files

cgroups: implement namespace tracking subsystem 



When a task enters a new namespace via a clone() or unshare(), a new cgroup
is created and the task moves into it.

This version names cgroups which are automatically created using
cgroup_clone() as "node_<pid>" where pid is the pid of the unsharing or
cloned process.  (Thanks Pavel for the idea) This is safe because if the
process unshares again, it will create

	/cgroups/(...)/node_<pid>/node_<pid>

The only possibilities (AFAICT) for a -EEXIST on unshare are

	1. pid wraparound
	2. a process fails an unshare, then tries again.

Case 1 is unlikely enough that I ignore it (at least for now).  In case 2, the
node_<pid> will be empty and can be rmdir'ed to make the subsequent unshare()
succeed.

Changelog:
	Name cloned cgroups as "node_<pid>".

[clg@fr.ibm.com: fix order of cgroup subsystems in init/Kconfig]
Signed-off-by: default avatarSerge E. Hallyn <serue@us.ibm.com>
Cc: Paul Menage <menage@google.com>
Signed-off-by: default avatarCedric Le Goater <clg@fr.ibm.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 846c7bb0

include/linux/cgroup_subsys.h

+6 −0
Original line number Diff line number Diff line
@@ -24,3 +24,9 @@ SUBSYS(debug) 
#endif



/* */



#ifdef CONFIG_CGROUP_NS

SUBSYS(ns)

#endif



/* */

include/linux/nsproxy.h

+7 −0
Original line number Diff line number Diff line
@@ -55,4 +55,11 @@ static inline void exit_task_namespaces(struct task_struct *p) 
		put_nsproxy(ns);

	}

}



#ifdef CONFIG_CGROUP_NS

int ns_cgroup_clone(struct task_struct *tsk);

#else

static inline int ns_cgroup_clone(struct task_struct *tsk) { return 0; }

#endif



#endif

init/Kconfig

+16 −7
Original line number Diff line number Diff line
@@ -288,6 +288,22 @@ config CGROUP_DEBUG 


	  Say N if unsure



config CGROUP_NS

        bool "Namespace cgroup subsystem"

        depends on CGROUPS

        help

          Provides a simple namespace cgroup subsystem to

          provide hierarchical naming of sets of namespaces,

          for instance virtual servers and checkpoint/restart

          jobs.



config CGROUP_CPUACCT

	bool "Simple CPU accounting cgroup subsystem"

	depends on CGROUPS

	help

	  Provides a simple Resource Controller for monitoring the

	  total CPU consumed by the tasks in a cgroup



config CPUSETS

	bool "Cpuset support"

	depends on SMP && CGROUPS
@@ -345,13 +361,6 @@ config PROC_PID_CPUSET 
	depends on CPUSETS

	default y



config CGROUP_CPUACCT

	bool "Simple CPU accounting cgroup subsystem"

	depends on CGROUPS

	help

	  Provides a simple Resource Controller for monitoring the

	  total CPU consumed by the tasks in a cgroup



config RELAY

	bool "Kernel->user space relay support (formerly relayfs)"

	help

kernel/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -40,6 +40,7 @@ obj-$(CONFIG_CGROUPS) += cgroup.o 
obj-$(CONFIG_CGROUP_DEBUG) += cgroup_debug.o

obj-$(CONFIG_CPUSETS) += cpuset.o

obj-$(CONFIG_CGROUP_CPUACCT) += cpu_acct.o

obj-$(CONFIG_CGROUP_NS) += ns_cgroup.o

obj-$(CONFIG_IKCONFIG) += configs.o

obj-$(CONFIG_STOP_MACHINE) += stop_machine.o

obj-$(CONFIG_AUDIT) += audit.o auditfilter.o

kernel/ns_cgroup.c

0 → 100644
+100 −0
Original line number Diff line number Diff line 
/*

 * ns_cgroup.c - namespace cgroup subsystem

 *

 * Copyright 2006, 2007 IBM Corp

 */



#include <linux/module.h>

#include <linux/cgroup.h>

#include <linux/fs.h>



struct ns_cgroup {

	struct cgroup_subsys_state css;

	spinlock_t lock;

};



struct cgroup_subsys ns_subsys;



static inline struct ns_cgroup *cgroup_to_ns(

		struct cgroup *cgroup)

{

	return container_of(cgroup_subsys_state(cgroup, ns_subsys_id),

			    struct ns_cgroup, css);

}



int ns_cgroup_clone(struct task_struct *task)

{

	return cgroup_clone(task, &ns_subsys);

}



/*

 * Rules:

 *   1. you can only enter a cgroup which is a child of your current

 *     cgroup

 *   2. you can only place another process into a cgroup if

 *     a. you have CAP_SYS_ADMIN

 *     b. your cgroup is an ancestor of task's destination cgroup

 *       (hence either you are in the same cgroup as task, or in an

 *        ancestor cgroup thereof)

 */

static int ns_can_attach(struct cgroup_subsys *ss,

		struct cgroup *new_cgroup, struct task_struct *task)

{

	struct cgroup *orig;



	if (current != task) {

		if (!capable(CAP_SYS_ADMIN))

			return -EPERM;



		if (!cgroup_is_descendant(new_cgroup))

			return -EPERM;

	}



	if (atomic_read(&new_cgroup->count) != 0)

		return -EPERM;



	orig = task_cgroup(task, ns_subsys_id);

	if (orig && orig != new_cgroup->parent)

		return -EPERM;



	return 0;

}



/*

 * Rules: you can only create a cgroup if

 *     1. you are capable(CAP_SYS_ADMIN)

 *     2. the target cgroup is a descendant of your own cgroup

 */

static struct cgroup_subsys_state *ns_create(struct cgroup_subsys *ss,

						struct cgroup *cgroup)

{

	struct ns_cgroup *ns_cgroup;



	if (!capable(CAP_SYS_ADMIN))

		return ERR_PTR(-EPERM);

	if (!cgroup_is_descendant(cgroup))

		return ERR_PTR(-EPERM);



	ns_cgroup = kzalloc(sizeof(*ns_cgroup), GFP_KERNEL);

	if (!ns_cgroup)

		return ERR_PTR(-ENOMEM);

	spin_lock_init(&ns_cgroup->lock);

	return &ns_cgroup->css;

}



static void ns_destroy(struct cgroup_subsys *ss,

			struct cgroup *cgroup)

{

	struct ns_cgroup *ns_cgroup;



	ns_cgroup = cgroup_to_ns(cgroup);

	kfree(ns_cgroup);

}



struct cgroup_subsys ns_subsys = {

	.name = "ns",

	.can_attach = ns_can_attach,

	.create = ns_create,

	.destroy  = ns_destroy,

	.subsys_id = ns_subsys_id,

};