[PATCH] Relax ns_can_attach checks to allow attaching to grandchild cgroups

[Li Zefan]

Grzegorz Nosek wrote:
> The ns_proxy cgroup allows moving processes to child cgroups only one
> level deep at a time. This commit relaxes this restriction and makes it
> possible to attach tasks directly to grandchild cgroups, e.g.:
> 
> ($pid is in the root cgroup)
> echo $pid > /cgroup/CG1/CG2/tasks
> 
> Previously this operation would fail with -EPERM and would have to be
> performed as two steps:
> echo $pid > /cgroup/CG1/tasks
> echo $pid > /cgroup/CG1/CG2/tasks
> 
> Also, the target cgroup no longer needs to be empty to move a task there.
> 
> Signed-off-by: Grzegorz Nosek <root at localdomain.pl>

Reviewed-by: Li Zefan <lizf at cn.fujitsu.com>

> ---
>  include/linux/cgroup.h |    4 ++--
>  kernel/cgroup.c        |   11 ++++++-----
>  kernel/ns_cgroup.c     |   14 ++++----------
>  3 files changed, 12 insertions(+), 17 deletions(-)