From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id D87C5C369C2 for ; Tue, 22 Apr 2025 09:48:32 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 9342B6B0007; Tue, 22 Apr 2025 05:48:30 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 8E2026B000A; Tue, 22 Apr 2025 05:48:30 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 7A7E26B000C; Tue, 22 Apr 2025 05:48:30 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 609E06B0007 for ; Tue, 22 Apr 2025 05:48:30 -0400 (EDT) Received: from smtpin28.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 4DF2A141A7E for ; Tue, 22 Apr 2025 09:48:31 +0000 (UTC) X-FDA: 83361204822.28.9F42AFA Received: from tor.source.kernel.org (tor.source.kernel.org [172.105.4.254]) by imf01.hostedemail.com (Postfix) with ESMTP id A6F8440004 for ; Tue, 22 Apr 2025 09:48:29 +0000 (UTC) Authentication-Results: imf01.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=Us9FFHOQ; dmarc=pass (policy=quarantine) header.from=kernel.org; spf=pass (imf01.hostedemail.com: domain of brauner@kernel.org designates 172.105.4.254 as permitted sender) smtp.mailfrom=brauner@kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1745315309; a=rsa-sha256; cv=none; b=mObpdGAq3OMBvUHPqfZNiPi1h61U47wQIpXJb7kuQUDA5pdZEk4lxhgP7ndCZeSx/svsEk rjuxID5IBkTDgqwZonULpVRju6PXMMVHbJ07YE8U4sFGlRz787Cq8PPpRU9H1A8eKBGYXM hjjDCUHdIMC/4/apdIYjPBbwn9bU8Mo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1745315309; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=nxCGjRTM/yTntp/vZYsN+8JDCg37xiLAVvnYoODsv/E=; b=aM3AeNrCWB5TljunJE3oALock6PA8PCtxUsc6yoEfsJph3wmW281+w8NDWpgUxk3khvY4q 376D17Z/HJqDx5Eg/ELHidyiGcwReW1eMDPTE+raHzE9hbJemnrLmoEYHjG6TE7naaYSnu mv3femXuRLbRnEM9CYJCMKTxSLSJ5A8= ARC-Authentication-Results: i=1; imf01.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=Us9FFHOQ; dmarc=pass (policy=quarantine) header.from=kernel.org; spf=pass (imf01.hostedemail.com: domain of brauner@kernel.org designates 172.105.4.254 as permitted sender) smtp.mailfrom=brauner@kernel.org Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by tor.source.kernel.org (Postfix) with ESMTP id 0038561365; Tue, 22 Apr 2025 09:48:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 558CBC4CEE9; Tue, 22 Apr 2025 09:48:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1745315308; bh=F/z8c26wHkzHaROXkny7shU6M6OS0DqFGLKEbifOWY8=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=Us9FFHOQmjkpBlN5cn6xPNP+Qjsi1tmLPi/jlEzyQChYIvmiOaPHdtzBV7eFfWFr/ +DMMbfAunIkFbDyqite2Q8uyHo6cE8FPt0jMpG9DpbJ6IM10UbpDqZEKBjqo7S9X05 vxvCc35NNem4wJrB3JllSLj+1e8zuYP0vMNQ9KXF8wRqdnkgbUX+9R3GZxzLKjZuWP CRajPI9VHh+OEwC/FCbWOqldTphYl5rRUoBQCXkzx2rqKAr6aJz7haxDh30UpW8Pck lew8DA4NzX6AYIHDkOg+0COZacePRaH183p7oG2KHxN8nc652OLFJJdiWP6aKN448v 8j6i8lk80aZkg== Date: Tue, 22 Apr 2025 11:48:23 +0200 From: Christian Brauner To: Michal =?utf-8?Q?Koutn=C3=BD?= Cc: Shakeel Butt , Andrew Morton , Johannes Weiner , Michal Hocko , Roman Gushchin , Muchun Song , Yosry Ahmed , Tejun Heo , Greg Thelen , linux-mm@kvack.org, cgroups@vger.kernel.org, linux-kernel@vger.kernel.org, Meta kernel team Subject: Re: [PATCH v2] memcg: introduce non-blocking limit setting option Message-ID: <20250422-synergie-bauabschnitt-5f724f1d9866@brauner> References: <20250419183545.1982187-1-shakeel.butt@linux.dev> <20250422-daumen-ozonbelastung-93d90ca81dfa@brauner> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: A6F8440004 X-Stat-Signature: ws7k7tj53sw58o5wm7o5pntk5py635j7 X-Rspam-User: X-HE-Tag: 1745315309-993833 X-HE-Meta: U2FsdGVkX18weqyH8uO/6rtKq6eQ/2BFmwYlzYIt9aWw6GJuBll54nWHE3xU71lMy5kxJkpPs2BK8tvdX/XOoA1VQaTqXZ4AtXkeXTi3ViJYPpINBY0Gv1CvvuorvBR1AeHz9MondKrSZeMTy/c60TXlOFMoe8+D5N8dkWwi5LDzbQesMwpzeD8R7G65Vo1xjRQPOZshSAoJCpwlTRDOB4cOIIJqUO/6QBJuMfiVZYzHAmIMbOv7ibABjBDU0hZzmEbulSE/AU8zTsbZM5bzrZILZv2k2H5BcyAX+EmTCwXX8+LoeZcigQEsWTY4QpRI1PVloDlEZrpdN4WzHEty0C5OIFMecH5BiRYPfrYWf9DJgVmuJYnrq3nPlbtTH62xU1/YGdJnaytfzzLuEZljUZ3ixjitmnmNCXaFvJn9F7kc3CKhAVIdppguH4BjCGhi/gc5Y/NRRCbN82S6YWsk5NFn5OFRfdXQf1esGAkSW+mqCvaaN9J8fepnABMK/Q2BgMgF0NFPHd0tNcPG32B4k4k5xEmEz2tKckS7BG8g4CjrokOqKWJ6cB5+srHZmtcXIYlOaHW+i1EsvSEUezlYoaRC23sFurPMHNMV1lER3EnhQGJwOc8qVTw0IEDK5hQdyg9CEYlB29RMzWW1F7xKaCuVq/8eIdMwonGVfW9n6YSGVxrCiKpMNXDN0bQsQcGyE5FxbVT7SoS5MMuKQ7h8jfyDEX0RzCtiac8glYBsYrN7ZOdTsBCgZFRq4cwk2HoN6Yyebg6p5HL33cqCHx2Ud8cOcXci5blfSS0yck0JXrGvrIJ3sP6mDMQUYztK9O6svuvlOXV9ElaDzp5JArhGoCE6yH92sk8Cq2GY8vVHta8b8EJJRTDEuyCa/1Ozvz8a6c8ANrRN99l1ztlD9EV9vNSxkODjbpczWlT+Aox+YsmCq9FGRrIRzhOIULeDUjIBDo/bRkYcpw0xJCkpDun OhQx2ZK9 CfZejYDN1HpcB+8mjCp3wwdRJxzkSH/G53Sq4bM+TDzIDnlMxHl2/u/HdlDHHB6ydXjZNGaErDwtJh7fkO+xHP8VTvUfmfsXHHPZwtyt50bBV2MkTY2Cx2R3fK2zF+eBjK4GgVq+nwamuFRMO3jDDKsBYDQAgVYqO9Eg1T/QXLG/mEi48SLUIcnPhusKSgJDiaG3UtO9cGxmfw7FIWYlq5P6OEF4Z2hIsOPQFR5K9RCoT6AAc0hujIDBtQIb5e9bPel935IwQxihHqJRUYnSTgQ7lQxkTrSZub4u7LD85kthcyTBKdWS1exnTsHdJ5jL1xmr8jK8uK7m5xvks04wC+P6yWY/+7QZO3Qzq X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Tue, Apr 22, 2025 at 11:31:23AM +0200, Michal Koutný wrote: > On Tue, Apr 22, 2025 at 11:23:17AM +0200, Christian Brauner wrote: > > As written this isn't restricted to admin processes though, no? So any > > unprivileged container can open that file O_NONBLOCK and avoid > > synchronous reclaim? > > > > Which might be fine I have no idea but it's something to explicitly > > point out > > It occurred to me as well but I think this is fine -- changing the > limits of a container is (should be) a privileged operation already > (ensured by file permissions at opening). > IOW, this doesn't allow bypassing the limits to anyone who couldn't have > been able to change them already. Hm, can you explain what you mean by a privileged operation here? If I have nested containers with user namespaces with delegated cgroup tress, i.e., chowned to them and then some PID 1 or privileged container _within the user namespace_ lowers the limit and uses O_NONBLOCK then it won't trigger synchronous reclaim. Again, this might all be fine I'm just trying to understand.