2 * ns_cgroup.c - namespace cgroup subsystem
4 * Copyright 2006, 2007 IBM Corp
7 #include <linux/module.h>
8 #include <linux/cgroup.h>
10 #include <linux/slab.h>
11 #include <linux/nsproxy.h>
14 struct cgroup_subsys_state css;
18 struct cgroup_subsys ns_subsys;
20 static inline struct ns_cgroup *cgroup_to_ns(
21 struct cgroup *cgroup)
23 return container_of(cgroup_subsys_state(cgroup, ns_subsys_id),
24 struct ns_cgroup, css);
27 int ns_cgroup_clone(struct task_struct *task)
29 return cgroup_clone(task, &ns_subsys);
34 * 1. you can only enter a cgroup which is a child of your current
36 * 2. you can only place another process into a cgroup if
37 * a. you have CAP_SYS_ADMIN
38 * b. your cgroup is an ancestor of task's destination cgroup
39 * (hence either you are in the same cgroup as task, or in an
40 * ancestor cgroup thereof)
42 static int ns_can_attach(struct cgroup_subsys *ss,
43 struct cgroup *new_cgroup, struct task_struct *task)
47 if (current != task) {
48 if (!capable(CAP_SYS_ADMIN))
51 if (!cgroup_is_descendant(new_cgroup))
55 if (atomic_read(&new_cgroup->count) != 0)
58 orig = task_cgroup(task, ns_subsys_id);
59 if (orig && orig != new_cgroup->parent)
66 * Rules: you can only create a cgroup if
67 * 1. you are capable(CAP_SYS_ADMIN)
68 * 2. the target cgroup is a descendant of your own cgroup
70 static struct cgroup_subsys_state *ns_create(struct cgroup_subsys *ss,
71 struct cgroup *cgroup)
73 struct ns_cgroup *ns_cgroup;
75 if (!capable(CAP_SYS_ADMIN))
76 return ERR_PTR(-EPERM);
77 if (!cgroup_is_descendant(cgroup))
78 return ERR_PTR(-EPERM);
80 ns_cgroup = kzalloc(sizeof(*ns_cgroup), GFP_KERNEL);
82 return ERR_PTR(-ENOMEM);
83 spin_lock_init(&ns_cgroup->lock);
84 return &ns_cgroup->css;
87 static void ns_destroy(struct cgroup_subsys *ss,
88 struct cgroup *cgroup)
90 struct ns_cgroup *ns_cgroup;
92 ns_cgroup = cgroup_to_ns(cgroup);
96 struct cgroup_subsys ns_subsys = {
98 .can_attach = ns_can_attach,
100 .destroy = ns_destroy,
101 .subsys_id = ns_subsys_id,