ns_can_attach (nsproxy cgroup)

[Grzegorz Nosek]

Hi all,

Is there a good reason for ns_can_attach to restrict moving tasks only
to direct descentants of the current cgroup? I.e. could the code:

        orig = task_cgroup(task, ns_subsys_id);
        if (orig && orig != new_cgroup->parent)
                return -EPERM;

be replaced with:

        orig = task_cgroup(task, ns_subsys_id);
        if (orig && !cgroup_is_descendant_of(new_cgroup, orig))
                return -EPERM;

(for a suitable definition of cgroup_is_descendant_of). It would allow
moving tasks down the cgroup hierarchy more than one level at a time and
as far as I can see, would pose no additional problems.

Please keep CC'd, I'm not subscribed.

Best regards,
 Grzegorz Nosek