/* Rules: you can only create a cgroup if */
static struct cgroup_subsys_state* ns_create(struct cgroup_subsys *ss, struct cgroup *cgroup)
/* Rules: you can only create a cgroup if */
static struct cgroup_subsys_state* ns_create(struct cgroup_subsys *ss, struct cgroup *cgroup)
{
	struct ns_cgroup *ns_cgroup;
	if (!capable(CAP_SYS_ADMIN))
		return ERR_PTR(-EPERM);
	if (!cgroup_is_descendant(cgroup, current))
		return ERR_PTR(-EPERM);
	ns_cgroup = kzalloc(sizeof(*ns_cgroup), GFP_KERNEL);
	if (!ns_cgroup)
		return ERR_PTR(-ENOMEM);
	return &ns_cgroup->css;
}