linux-kernel - Re: [proposal] delegating cgroup manager to non-PID1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.02.1503011610500.12474@nftneq.ynat.uz>
Date:	Sun, 1 Mar 2015 16:13:43 -0800 (PST)
From:	David Lang <david@...g.hm>
To:	Luke Kenneth Casson Leighton <lkcl@...l.net>
cc:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [proposal] delegating cgroup manager to non-PID1

On Sun, 1 Mar 2015, Luke Kenneth Casson Leighton wrote:

> in recent discussions about PID-1 alternatives (sysvinit, openrc,
> systemd, depinit) i was alerted to the idea that PID1 is to become the
> sole exlcusive process permitted to manage cgroups.  given that, just
> as one specific example, depinit is only around 2,300 lines of c code,
> adding extra code to manage cgroups is of some concern especially in
> light of the general UNIX philosophy "do one thing and do it well".
>
> to allow the general UNIX philosophy to be honoured, may i
> respectfully propose an additional linux kernel systemcall which
> permits delegation - solely and exclusively by PID1 - of the
> management of cgroups to one (and only one) other process, and that
> furthermore that the process must be an immediate child of PID1?

There is less agreement on the idea that PID1 will have exclusive control over 
cgroups than some of the posts make it seem. There are many people who use 
cgroups for things that PID1 (and systemd) aren't dealing with. The issue is 
that the people working to revamp cgroups are saying that allowing other 
processed to affect cgroups brings up hard problems that they don't want to deal 
with right now, so they want to make cgroups exclusive to PID1 as a 'temporary' 
measure, and then look at solving the problems that are needed to let other 
processes manage parts or all of the cgroups config.

David Lang
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/