Well the style of kernel preemption is generally an implementation
detail that is not visible to user space.
Bind all of the UP processes to a single cpu.
Right. But in a container that look like a full system arguably this
is doable. There are a few additional details that would be needed
to ensure containers are isolated from each other that would be
needed to ensure this is effective but those are fairly minor.
When we get to the point where this is a real concern I believe the
isolation will be sufficient that this it is a valid question to
ask.
If there is nothing visible to user space I don't care. But security
modules are fundamentally about changing when -EPERM happens so are
very visible to user space.
Eric
-
