summaryrefslogtreecommitdiffstats
path: root/kernel/Makefile
diff options
context:
space:
mode:
authorAleksa Sarai <cyphar@cyphar.com>2015-06-09 21:32:10 +1000
committerTejun Heo <tj@kernel.org>2015-07-14 17:29:23 -0400
commit49b786ea146f69c371df18e81ce0a2d5839f865c (patch)
tree8e7abdd61fb2a8e5d3b7ffbf263fc36d8f9969f5 /kernel/Makefile
parent7e47682ea555e7c1edef1d8fd96e2aa4c12abe59 (diff)
downloadlinux-49b786ea146f69c371df18e81ce0a2d5839f865c.tar.bz2
cgroup: implement the PIDs subsystem
Adds a new single-purpose PIDs subsystem to limit the number of tasks that can be forked inside a cgroup. Essentially this is an implementation of RLIMIT_NPROC that applies to a cgroup rather than a process tree. However, it should be noted that organisational operations (adding and removing tasks from a PIDs hierarchy) will *not* be prevented. Rather, the number of tasks in the hierarchy cannot exceed the limit through forking. This is due to the fact that, in the unified hierarchy, attach cannot fail (and it is not possible for a task to overcome its PIDs cgroup policy limit by attaching to a child cgroup -- even if migrating mid-fork it must be able to fork in the parent first). PIDs are fundamentally a global resource, and it is possible to reach PID exhaustion inside a cgroup without hitting any reasonable kmemcg policy. Once you've hit PID exhaustion, you're only in a marginally better state than OOM. This subsystem allows PID exhaustion inside a cgroup to be prevented. Signed-off-by: Aleksa Sarai <cyphar@cyphar.com> Signed-off-by: Tejun Heo <tj@kernel.org>
Diffstat (limited to 'kernel/Makefile')
-rw-r--r--kernel/Makefile1
1 files changed, 1 insertions, 0 deletions
diff --git a/kernel/Makefile b/kernel/Makefile
index 43c4c920f30a..718fb8afab7a 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -55,6 +55,7 @@ obj-$(CONFIG_BACKTRACE_SELF_TEST) += backtracetest.o
obj-$(CONFIG_COMPAT) += compat.o
obj-$(CONFIG_CGROUPS) += cgroup.o
obj-$(CONFIG_CGROUP_FREEZER) += cgroup_freezer.o
+obj-$(CONFIG_CGROUP_PIDS) += cgroup_pids.o
obj-$(CONFIG_CPUSETS) += cpuset.o
obj-$(CONFIG_UTS_NS) += utsname.o
obj-$(CONFIG_USER_NS) += user_namespace.o