lkml.org 
[lkml]   [2008]   [Jul]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [RFC] How to handle the rules engine for cgroups
    On Thu, 10 Jul 2008 02:23:52 -0700
    "Paul Menage" <menage@google.com> wrote:

    > I don't see the rule-based approach being all that useful for our needs.

    Agreed, there really is no need for a rule-based approach in kernel space.

    There are basically three different cases:

    1) daemons get started up in their own process groups, this can
    be handled by the initscripts

    2) user sessions (ssh, etc) start in their own process groups,
    this can be handled by PAM

    3) users fork processes that should go into special process
    groups - this could be handled by having a small ruleset
    in userspace handle things, right before calling exec(),
    it can even be hidden from the application by hooking into
    the exec() call

    If a user overrides the rules for their own processes, at worst
    s/he takes away resources from him/herself. No security problem.

    Is there any reason at all to push for a kernel side rule-based
    engine, except "I want to make my patch set unmergeable?"

    --
    All Rights Reversed


    \
     
     \ /
      Last update: 2008-07-10 16:55    [W:0.022 / U:30.152 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site