v2: 
  - Add a new CS_TASKS_OUT flag to signal that task migration out of
    empty cpuset is allowed without setsched security check as suggested
    by Tejun.
  - Add 2 more patches with minor changes.

As it is found that the cpuset v1 task migration out of cpuset with no
CPU can be blocked by a strict security policy, we need to work around
that issue by treating it as an exceptional case that is allowed without
security check. This is now enabled by setting a special CS_TASKS_OUT
flag of the affected cpuset to allow cpuset_can_attach() to skip security
check in this special case.

Waiman Long (3):
  cgroup/cpuset: Simplify setsched decision check in task iteration loop
    of cpuset_can_attach()
  cgroup/cpuset: Skip security check for hotplug induced v1 task
    migration
  cgroup/cpuset: Improve check for v1 task migration out of empty cpuset

 kernel/cgroup/cpuset-internal.h |  1 +
 kernel/cgroup/cpuset-v1.c       | 13 +++++++++----
 kernel/cgroup/cpuset.c          | 33 ++++++++++++++++++++++++---------
 3 files changed, 34 insertions(+), 13 deletions(-)

-- 
2.53.0