2 * ns_cgroup.c - namespace cgroup subsystem
4 * Copyright 2006, 2007 IBM Corp
7 #include <linux/module.h>
8 #include <linux/cgroup.h>
10 #include <linux/proc_fs.h>
11 #include <linux/slab.h>
12 #include <linux/nsproxy.h>
15 struct cgroup_subsys_state css
;
18 struct cgroup_subsys ns_subsys
;
20 static inline struct ns_cgroup
*cgroup_to_ns(
21 struct cgroup
*cgroup
)
23 return container_of(cgroup_subsys_state(cgroup
, ns_subsys_id
),
24 struct ns_cgroup
, css
);
27 int ns_cgroup_clone(struct task_struct
*task
, struct pid
*pid
)
29 char name
[PROC_NUMBUF
];
31 snprintf(name
, PROC_NUMBUF
, "%d", pid_vnr(pid
));
32 return cgroup_clone(task
, &ns_subsys
, name
);
37 * 1. you can only enter a cgroup which is a descendant of your current
39 * 2. you can only place another process into a cgroup if
40 * a. you have CAP_SYS_ADMIN
41 * b. your cgroup is an ancestor of task's destination cgroup
42 * (hence either you are in the same cgroup as task, or in an
43 * ancestor cgroup thereof)
45 static int ns_can_attach(struct cgroup_subsys
*ss
, struct cgroup
*new_cgroup
,
46 struct task_struct
*task
, bool threadgroup
)
48 if (current
!= task
) {
49 if (!capable(CAP_SYS_ADMIN
))
52 if (!cgroup_is_descendant(new_cgroup
, current
))
56 if (!cgroup_is_descendant(new_cgroup
, task
))
60 struct task_struct
*c
;
62 list_for_each_entry_rcu(c
, &task
->thread_group
, thread_group
) {
63 if (!cgroup_is_descendant(new_cgroup
, c
)) {
75 * Rules: you can only create a cgroup if
76 * 1. you are capable(CAP_SYS_ADMIN)
77 * 2. the target cgroup is a descendant of your own cgroup
79 static struct cgroup_subsys_state
*ns_create(struct cgroup_subsys
*ss
,
80 struct cgroup
*cgroup
)
82 struct ns_cgroup
*ns_cgroup
;
84 if (!capable(CAP_SYS_ADMIN
))
85 return ERR_PTR(-EPERM
);
86 if (!cgroup_is_descendant(cgroup
, current
))
87 return ERR_PTR(-EPERM
);
89 ns_cgroup
= kzalloc(sizeof(*ns_cgroup
), GFP_KERNEL
);
91 return ERR_PTR(-ENOMEM
);
92 return &ns_cgroup
->css
;
95 static void ns_destroy(struct cgroup_subsys
*ss
,
96 struct cgroup
*cgroup
)
98 struct ns_cgroup
*ns_cgroup
;
100 ns_cgroup
= cgroup_to_ns(cgroup
);
104 struct cgroup_subsys ns_subsys
= {
106 .can_attach
= ns_can_attach
,
108 .destroy
= ns_destroy
,
109 .subsys_id
= ns_subsys_id
,
This page took 0.032974 seconds and 6 git commands to generate.