[PATCHv2 7/7] cgroup: mount cgroupns-root when inside non-init cgroupns

[Andy Lutomirski]

On Mon, Nov 3, 2014 at 3:23 PM, Aditya Kali <adityakali at google.com> wrote:
> On Mon, Nov 3, 2014 at 3:15 PM, Andy Lutomirski <luto at amacapital.net> wrote:
>> On Mon, Nov 3, 2014 at 3:12 PM, Aditya Kali <adityakali at google.com> wrote:
>>> On Fri, Oct 31, 2014 at 5:07 PM, Andy Lutomirski <luto at amacapital.net> wrote:
>>>> On Fri, Oct 31, 2014 at 12:19 PM, Aditya Kali <adityakali at google.com> wrote:
>>>>>         if (opts->flags & CGRP_ROOT_SANE_BEHAVIOR) {
>>>>>                 pr_warn("sane_behavior: this is still under development and its behaviors will change, proceed at your own risk\n");
>>>>> -               if (nr_opts != 1) {
>>>>> +               if (nr_opts > 1) {
>>>>>                         pr_err("sane_behavior: no other mount options allowed\n");
>>>>>                         return -EINVAL;
>>>>
>>>> This looks wrong.  But, if you make the change above, then it'll be right.
>>>>
>>>
>>> It would have been nice if simple 'mount -t cgroup cgroup <mnt>' from
>>> cgroupns does the right thing automatically.
>>>
>>
>> This is a debatable point, but it's not what I meant.  Won't your code
>> let 'mount -t cgroup -o one_evil_flag cgroup mountpoint' through?
>>
>
> I don't think so. This check "if (nr_opts > 1)" is nested under "if
> (opts->flags & CGRP_ROOT_SANE_BEHAVIOR)". So we know that there is
> atleast 1 option ('__DEVEL__sane_behavior') present (implicit or not).
> Addition of 'one_evil_flag' will make nr_opts = 2 and result in EINVAL
> here.

But the implicit __DEVEL__sane_behavior doesn't increment nr_opts, right?

--Andy