linux-kernel - Re: [PATCH] cgroup: deprecate remount option changes and "name=" mount option

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 15 Mar 2012 20:33:32 +0100
From:	Lennart Poettering <mzxreary@...inter.de>
To:	Tejun Heo <tj@...nel.org>
Cc:	Li Zefan <lizf@...fujitsu.com>,
	containers@...ts.linux-foundation.org, cgroups@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Frederic Weisbecker <fweisbec@...il.com>
Subject: Re: [PATCH] cgroup: deprecate remount option changes and "name="
  mount option

On Thu, 15.03.12 09:54, Tejun Heo (tj@...nel.org) wrote:

> 
> Hello,
> 
> On Thu, Mar 15, 2012 at 12:29:25AM +0100, Lennart Poettering wrote:
> > Hmm, this is not clear to me. Are you intending to remove the name=
> > mount option entirely, or just intend to remove that you can change it
> > in remounts?
> > 
> > systemd uses name=systemd to get its own private cgroup tree, that has
> > no controller bound, hence we kinda need this option. Or are you
> > suggesting there was an other way to get a private cgroup tree that
> > systemd can use for grouping and labelling things?
> 
> Eh, you're right.  I want to remove support for duplicate mounting by
> name or subsys as it just isn't necessary, so what I want is,
> 
> * "mount -t cgroupfs -o SUBSYS" will fail if SUBSYS is already mounted
>   somewhere else.
> 
> * "mount -t cgroupfs -o none" will always create a new cgroup
>   hierarchy w/o any controller attached.
> 
> I didn't realize that the mount code didn't allow none w/o name and
> now I don't see a non-intrusive way to remove the name option. :( Eh
> well, I'll drop that part.

Insisting on a name or controller (i.e. not allowing completely
anonymous cgroupfs mounts) is probably a good idea since otherwise the
data in /proc/$PID/cgroup might be a bit useless since you couldn't
sensible match up the data in there with your mount point.

Multiple mounts of the same tree can go, as long as bind mounting is
still supported so that we can make the cgroup tree available in limited
form to containers and such.

Lennart

-- 
Lennart Poettering - Red Hat, Inc.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/