lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 5 Nov 2020 10:52:05 -0500 From: Joel Fernandes <joel@...lfernandes.org> To: "Li, Aubrey" <aubrey.li@...ux.intel.com> Cc: Nishanth Aravamudan <naravamudan@...italocean.com>, Julien Desfossez <jdesfossez@...italocean.com>, Peter Zijlstra <peterz@...radead.org>, Tim Chen <tim.c.chen@...ux.intel.com>, Vineeth Pillai <viremana@...ux.microsoft.com>, Aaron Lu <aaron.lwe@...il.com>, Aubrey Li <aubrey.intel@...il.com>, tglx@...utronix.de, linux-kernel@...r.kernel.org, mingo@...nel.org, torvalds@...ux-foundation.org, fweisbec@...il.com, keescook@...omium.org, kerrnel@...gle.com, Phil Auld <pauld@...hat.com>, Valentin Schneider <valentin.schneider@....com>, Mel Gorman <mgorman@...hsingularity.net>, Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>, Paolo Bonzini <pbonzini@...hat.com>, vineeth@...byteword.org, Chen Yu <yu.c.chen@...el.com>, Christian Brauner <christian.brauner@...ntu.com>, Agata Gruza <agata.gruza@...el.com>, Antonio Gomez Iglesias <antonio.gomez.iglesias@...el.com>, graf@...zon.com, konrad.wilk@...cle.com, dfaggioli@...e.com, pjt@...gle.com, rostedt@...dmis.org, derkling@...gle.com, benbjiang@...cent.com, Alexandre Chartre <alexandre.chartre@...cle.com>, James.Bottomley@...senpartnership.com, OWeisse@...ch.edu, Dhaval Giani <dhaval.giani@...cle.com>, Junaid Shahid <junaids@...gle.com>, jsbarnes@...gle.com, chris.hyser@...cle.com, "Paul E. McKenney" <paulmck@...nel.org>, Tim Chen <tim.c.chen@...el.com> Subject: Re: [PATCH v8 -tip 19/26] sched: Add a second-level tag for nested CGroup usecase On Wed, Oct 28, 2020 at 02:23:02PM +0800, Li, Aubrey wrote: > On 2020/10/20 9:43, Joel Fernandes (Google) wrote: > > Google has a usecase where the first level tag to tag a CGroup is not > > sufficient. So, a patch is carried for years where a second tag is added which > > is writeable by unprivileged users. > > > > Google uses DAC controls to make the 'tag' possible to set only by root while > > the second-level 'color' can be changed by anyone. The actual names that > > Google uses is different, but the concept is the same. > > > > The hierarchy looks like: > > > > Root group > > / \ > > A B (These are created by the root daemon - borglet). > > / \ \ > > C D E (These are created by AppEngine within the container). > > > > The reason why Google has two parts is that AppEngine wants to allow a subset of > > subcgroups within a parent tagged cgroup sharing execution. Think of these > > subcgroups belong to the same customer or project. Because these subcgroups are > > created by AppEngine, they are not tracked by borglet (the root daemon), > > therefore borglet won't have a chance to set a color for them. That's where > > 'color' file comes from. Color could be set by AppEngine, and once set, the > > normal tasks within the subcgroup would not be able to overwrite it. This is > > enforced by promoting the permission of the color file in cgroupfs. > > > > The 'color' is a 8-bit value allowing for upto 256 unique colors. IMHO, having > > more than these many CGroups sounds like a scalability issue so this suffices. > > We steal the lower 8-bits of the cookie to set the color. > > > > So when color = 0, tasks in group A C D can run together on the HTs in same core, > And if I set the color of taskC in group C = 1, then taskC has a different cookie > from taskA and taskD, so in terms of taskA, what's the difference between taskC > and [taskB or taskE]? The color breaks the relationship that C belongs to A. C does belong to A in the sense, A cannot share with B, this implies C can never share with B. Setting C's color does not change that fact. So coloring is irrelevant in your question. Sure, A cannot share with C either after coloring, but that's irrelevant and not the point of doing the coloring. thanks, - Joel
Powered by blists - more mailing lists