2 * ns_cgroup.c - namespace cgroup subsystem
4 * Copyright 2006, 2007 IBM Corp
7 #include <linux/module.h>
8 #include <linux/cgroup.h>
10 #include <linux/slab.h>
11 #include <linux/nsproxy.h>
14 struct cgroup_subsys_state css
;
18 struct cgroup_subsys ns_subsys
;
20 static inline struct ns_cgroup
*cgroup_to_ns(
21 struct cgroup
*cgroup
)
23 return container_of(cgroup_subsys_state(cgroup
, ns_subsys_id
),
24 struct ns_cgroup
, css
);
27 int ns_cgroup_clone(struct task_struct
*task
)
29 return cgroup_clone(task
, &ns_subsys
);
34 * 1. you can only enter a cgroup which is a child of your current
36 * 2. you can only place another process into a cgroup if
37 * a. you have CAP_SYS_ADMIN
38 * b. your cgroup is an ancestor of task's destination cgroup
39 * (hence either you are in the same cgroup as task, or in an
40 * ancestor cgroup thereof)
42 static int ns_can_attach(struct cgroup_subsys
*ss
,
43 struct cgroup
*new_cgroup
, struct task_struct
*task
)
47 if (current
!= task
) {
48 if (!capable(CAP_SYS_ADMIN
))
51 if (!cgroup_is_descendant(new_cgroup
))
55 if (atomic_read(&new_cgroup
->count
) != 0)
58 orig
= task_cgroup(task
, ns_subsys_id
);
59 if (orig
&& orig
!= new_cgroup
->parent
)
66 * Rules: you can only create a cgroup if
67 * 1. you are capable(CAP_SYS_ADMIN)
68 * 2. the target cgroup is a descendant of your own cgroup
70 static struct cgroup_subsys_state
*ns_create(struct cgroup_subsys
*ss
,
71 struct cgroup
*cgroup
)
73 struct ns_cgroup
*ns_cgroup
;
75 if (!capable(CAP_SYS_ADMIN
))
76 return ERR_PTR(-EPERM
);
77 if (!cgroup_is_descendant(cgroup
))
78 return ERR_PTR(-EPERM
);
80 ns_cgroup
= kzalloc(sizeof(*ns_cgroup
), GFP_KERNEL
);
82 return ERR_PTR(-ENOMEM
);
83 spin_lock_init(&ns_cgroup
->lock
);
84 return &ns_cgroup
->css
;
87 static void ns_destroy(struct cgroup_subsys
*ss
,
88 struct cgroup
*cgroup
)
90 struct ns_cgroup
*ns_cgroup
;
92 ns_cgroup
= cgroup_to_ns(cgroup
);
96 struct cgroup_subsys ns_subsys
= {
98 .can_attach
= ns_can_attach
,
100 .destroy
= ns_destroy
,
101 .subsys_id
= ns_subsys_id
,
This page took 0.032286 seconds and 5 git commands to generate.