OpenVZ Forum - RDF feed
type: channel
items: [PATCH 0/5] A config option to compile out some namespaces code
items: [PATCH 1/5] The config option itself
items: [PATCH 2/5] Move the UST namespace under the option
items: [PATCH 3/5] Move the IPC namespace under the option
items: [PATCH 4/5] Move the user namespace under the option
items: [PATCH 5/5] Move the PID namespace under the option
items: Re: [PATCH 1/5] The config option itself
items: Re: [PATCH 2/5] Move the UST namespace under the option
items: Re: [PATCH 4/5] Move the user namespace under the option
items: Re: [PATCH 3/5] Move the IPC namespace under the option

[PATCH 0/5] A config option to compile out some namespaces code
type: item
description: There were some questions like "do I need this on my cellphone" in reply to different namespaces patches. Indeed, the namespaces are not useful for most of the embedded systems, but the code creating and releasing them weights a lot. So I propose to add a config option which will help embedded people to reduce the vmlinux size. This option simply compiles out the namespaces cloning and releasing code *only*, but keeps all the other logic untouched (e.g. the notion of init_ns). When someone tries to clone some namespace with their support turned off, he will receive an EINVAL error. This patchset can save more than 2KB from the vmlinux when turning the config option "NAMESPACES" to "n": $ scripts/bloat-o-meter vmlinux-no-ns vmlinux-with-ns add/remove: 27/0 grow/shrink: 11/7 up/down: 2477/-340 (2137) function old new delta copy_pid_ns - 537 +537 copy_user_ns - 181 +181 copy_ipcs - 149 +149 zap_pid_ns_processes - 130 +130 copy_utsname - 120 +120 shm_exit_ns - 106 +106 sem_exit_ns - 106 +106 msg_exit_ns - 106 +106 freeary - 100 +100 release_uids - 95 +95 freeque - 92 +92 free_nsproxy 48 123 +75 create_new_namespaces 300 358 +58 free_pid_ns - 56 +56 pid_namespaces_init - 48 +48 __sem_init_ns - 45 +45 shm_init_ns - 42 +42 sem_init_ns - 42 +42 msg_init_ns - 42 +42 __shm_init_ns - 38 +38 __msg_init_ns - 31 +31 sysvipc_proc_release 5 35 +30 proc_kill_sb 5 35 +30 free_ipc_ns - 30 +30 do_shm_rmid - 29 +29 proc_set_super 13 38 +25 shm_release 18 39 +21 put_pid 75 95 +20 alloc_pid 687 706 +19 pid_caches_mutex - 16 +16 free_user_ns - 16 +16 sysvipc_proc_open 100 111 +11 do_shmat 778 787 +9 pid_caches_lh - 8 +8 free_uts_ns - 5 +5 pid_ns_cachep - 4 +4 __initcall_pid_namespaces_init6 - 4 +4 do_exit 1855 1856 +1 show_stat 1665 1661 -4 sys_shmctl 1934 1907 -27 msg_init 82 47 -35 shm_init 92 47 -45 sem_init 99 44 -55 sys_msgctl 1394 1311 -83 sys_semctl 2123 2032 -91 This set was reviewed and approved by Serge, Cedric and Eric. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> _________…
creator: Pavel Emelianov
date: 2007-09-26T15:39:57-00:00

[PATCH 1/5] The config option itself
type: item
description: The option is called NAMESPACES. It can be selectable only if EMBEDDED is chosen (this was Eric's requisition). When the EMBEDDED is off namespaces will be on automatically. One more option (NAMESPACES_EXPERIMENTAL) was added by Serge's request to move there all the namespaces that are not finished yet. Currently only the user and the network namespaces are such. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- diff --git a/init/Kconfig b/init/Kconfig index 684ccfb..05a71d7 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -369,6 +360,23 @@ config RELAY If unsure, say N. +config NAMESPACES + bool "The namespaces support" if EMBEDDED + default !EMBEDDED + help + Provides the way to make tasks work with different objects using + the same id. For example same IPC id may refer to different objects + or same user id or pid may refer to different tasks when used in + different namespaces. + +config NAMESPACES_EXPERIMENTAL + bool "Add the experimantal namespaces support" if EMBEDDED + depends on NAMESPACES && EXPERIMENTAL + default !EMBEDDED + help + Also include the support for the namespaces that are not fnished + or well developed yet + config BLK_DEV_INITRD bool "Initial RAM filesystem and RAM disk (initramfs/initrd) support" depends on BROKEN || !FRV _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: Pavel Emelianov
date: 2007-09-26T15:43:28-00:00

[PATCH 2/5] Move the UST namespace under the option
type: item
description: Currently all the namespace management code is in the kernel/utsname.c file, so just compile it out and make stub in .h file. The init namespace itself is in init/version.c and is left in the kernel. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- diff --git a/include/linux/utsname.h b/include/linux/utsname.h index 923db99..52b9116 100644 --- a/include/linux/utsname.h +++ b/include/linux/utsname.h @@ -35,6 +35,7 @@ struct new_utsname { #include <linux/sched.h> #include <linux/kref.h> #include <linux/nsproxy.h> +#include <linux/err.h> #include <asm/atomic.h> struct uts_namespace { @@ -43,6 +44,7 @@ struct uts_namespace { }; extern struct uts_namespace init_uts_ns; +#ifdef CONFIG_NAMESPACES static inline void get_uts_ns(struct uts_namespace *ns) { kref_get(&ns->kref); @@ -56,6 +58,25 @@ static inline void put_uts_ns(struct uts { kref_put(&ns->kref, free_uts_ns); } +#else +static inline void get_uts_ns(struct uts_namespace *ns) +{ +} + +static inline void put_uts_ns(struct uts_namespace *ns) +{ +} + +static inline struct uts_namespace *copy_utsname(unsigned long flags, + struct uts_namespace *ns) +{ + if (flags & CLONE_NEWUTS) + return ERR_PTR(-EINVAL); + + return ns; +} +#endif + static inline struct new_utsname *utsname(void) { return &current->nsproxy->uts_ns->name; diff --git a/kernel/Makefile b/kernel/Makefile index 76f782f..5817bfe 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -4,8 +4,7 @@ signal.o sys.o kmod.o workqueue.o pid.o \ rcupdate.o extable.o params.o posix-timers.o \ kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o mutex.o \ - hrtimer.o rwsem.o latency.o nsproxy.o srcu.o \ - utsname.o notifier.o sysctl.o + hrtimer.o rwsem.o latency.o nsproxy.o srcu.o notifier.o sysctl.o obj-$(CONFIG_SYSCTL) += sysctl_check.o obj-$(CONFIG_STACKTRACE) += stacktrace.o @@ -50,6 +49,7 @@ obj-$(CONFIG_AUDITSYSCALL) += auditsc.o obj-$(CONFIG_AUDIT_TREE) += audit_tree.o obj-$(CONFIG_KPROBES) += kprobes.o obj-$(CONFIG_KGDB) += kgdb.o +obj-$(CONFIG_NAMESPACES) +…
creator: Pavel Emelianov
date: 2007-09-26T15:46:16-00:00

[PATCH 3/5] Move the IPC namespace under the option
type: item
description: Currently all the IPC namespace management code is in ipc/util.c. I moved this code into ipc/namespace.c file which is compiled out when needed. The linux/ipc_namespace.h file is used to store the prototypes of the functions in namespace.c and the stubs for NAMESPACES=n case. This is done so, because the stub for copy_ipc_namespace requires the knoweledge of the CLONE_NEWIPC flag, which is in sched.h. But the linux/ipc.h file itself in included into many many .c files via the sys.h->sem.h sequence so adding the sched.h into it will make all these .c depend on sched.h which is not that good. On the other hand the knowledge about the namespaces stuff is required in 4 .c files only. Besides, this patch compiles out some auxiliary functions from ipc/sem.c, msg.c and shm.c files. Signied-off-by: Pavel Emelyanov <xemul@openvz.org> --- diff --git a/include/linux/ipc.h b/include/linux/ipc.h index 96988d1..b882610 100644 --- a/include/linux/ipc.h +++ b/include/linux/ipc.h @@ -100,56 +100,6 @@ struct kern_ipc_perm void *security; }; -struct ipc_ids; -struct ipc_namespace { - struct kref kref; - struct ipc_ids *ids[3]; - - int sem_ctls[4]; - int used_sems; - - int msg_ctlmax; - int msg_ctlmnb; - int msg_ctlmni; - - size_t shm_ctlmax; - size_t shm_ctlall; - int shm_ctlmni; - int shm_tot; -}; - -extern struct ipc_namespace init_ipc_ns; - -#ifdef CONFIG_SYSVIPC -#define INIT_IPC_NS(ns) .ns = &init_ipc_ns, -extern void free_ipc_ns(struct kref *kref); -extern struct ipc_namespace *copy_ipcs(unsigned long flags, - struct ipc_namespace *ns); -#else -#define INIT_IPC_NS(ns) -static inline struct ipc_namespace *copy_ipcs(unsigned long flags, - struct ipc_namespace *ns) -{ - return ns; -} -#endif - -static inline struct ipc_namespace *get_ipc_ns(struct ipc_namespace *ns) -{ -#ifdef CONFIG_SYSVIPC - if (ns) - kref_get(&ns->kref); -#endif - return ns; -} - -static inline void put_ipc_ns(struct ipc_namespace *ns) -{ -#ifdef CONFIG_SYSVIPC - kref_put(&ns->kref, free_ipc_ns); -#endif -} - #e…
creator: Pavel Emelianov
date: 2007-09-26T15:51:12-00:00

[PATCH 4/5] Move the user namespace under the option
type: item
description: We currently have a CONFIG_USER_NS option. Just rename it into CONFIG_NAMESPACES_EXPERIMANTAL and move the init_user_ns into user.c file to make the kernel compile and work without the namespaces support. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h index b5f41d4..dda160c 100644 --- a/include/linux/user_namespace.h +++ b/include/linux/user_namespace.h @@ -17,7 +17,7 @@ struct user_namespace { extern struct user_namespace init_user_ns; -#ifdef CONFIG_USER_NS +#ifdef CONFIG_NAMESPACES_EXPERIMENTAL static inline struct user_namespace *get_user_ns(struct user_namespace *ns) { diff --git a/init/Kconfig b/init/Kconfig index 684ccfb..0db1c3b 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -206,15 +206,6 @@ config TASK_IO_ACCOUNTING Say N if unsure. -config USER_NS - bool "User Namespaces (EXPERIMENTAL)" - default n - depends on EXPERIMENTAL - help - Support user namespaces. This allows containers, i.e. - vservers, to use user namespaces to provide different - user info for different servers. If unsure, say N. - config AUDIT bool "Auditing support" depends on NET diff --git a/kernel/Makefile b/kernel/Makefile index 76f782f..5817bfe 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -4,7 +4,7 @@ obj-y = sched.o fork.o exec_domain.o panic.o printk.o profile.o \ exit.o itimer.o time.o softirq.o resource.o \ - sysctl.o capability.o ptrace.o timer.o user.o user_namespace.o \ + sysctl.o capability.o ptrace.o timer.o user.o \ signal.o sys.o kmod.o workqueue.o pid.o \ rcupdate.o extable.o params.o posix-timers.o \ kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o mutex.o \ @@ -50,6 +49,7 @@ obj-$(CONFIG_AUDITSYSCALL) += auditsc.o obj-$(CONFIG_KPROBES) += kprobes.o obj-$(CONFIG_KGDB) += kgdb.o obj-$(CONFIG_NAMESPACES) += utsname.o +obj-$(CONFIG_NAMESPACES_EXPERIMENTAL) += user_namespace.o obj-$(CONFIG_SYSFS) += ksysfs.o obj-$(CONFIG_DETECT_SOFTLOCKUP) += softlockup.o obj-$(CONFIG_GENERIC_HARD…
creator: Pavel Emelianov
date: 2007-09-26T15:53:43-00:00

[PATCH 5/5] Move the PID namespace under the option
type: item
description: For the same reasons as with the IPC namespaces, all the prototypes and stuns go to the pid_namespace.h file. The namespace management code itself is moved to the pid_namespace.c file. The pid_namespace cache is created inside an initcall, i.e. a bit later than the pid hash is initialized. This is OK for now - no code in kernel tries to clone new pid namespaces before boot. The zap_pid_namespace() function is expanded into a BUG() when NAMESPACES is "n". This is normal as exiting the init namespace (the only namespace in this case) causes a panic() in exit_child_reaper() function anyway. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- diff --git a/include/linux/pid.h b/include/linux/pid.h index 4817c66..3215274 100644 --- a/include/linux/pid.h +++ b/include/linux/pid.h @@ -122,7 +122,8 @@ extern struct pid *find_ge_pid(int nr, s extern struct pid *alloc_pid(struct pid_namespace *ns); extern void FASTCALL(free_pid(struct pid *pid)); -extern void zap_pid_ns_processes(struct pid_namespace *pid_ns); + +int next_pidmap(struct pid_namespace *pid_ns, int last); /* * the helpers to get the pid's id seen from different namespaces diff --git a/include/linux/pid_namespace.h b/include/linux/pid_namespace.h index 0135c76..6d6bd18 100644 --- a/include/linux/pid_namespace.h +++ b/include/linux/pid_namespace.h @@ -6,6 +6,7 @@ #include <linux/threads.h> #include <linux/nsproxy.h> #include <linux/kref.h> +#include <linux/err.h> struct pidmap { atomic_t nr_free; @@ -29,6 +30,7 @@ struct pid_namespace { extern struct pid_namespace init_pid_ns; +#ifdef CONFIG_NAMESPACES static inline struct pid_namespace *get_pid_ns(struct pid_namespace *ns) { if (ns != &init_pid_ns) @@ -38,12 +40,37 @@ static inline struct pid_namespace *get_ extern struct pid_namespace *copy_pid_ns(unsigned long flags, struct pid_namespace *ns); extern void free_pid_ns(struct kref *kref); +extern void zap_pid_ns_processes(struct pid_namespace *pid_ns); static inline void put_pid_ns(struct pid_namespace *ns) { if…
creator: Pavel Emelianov
date: 2007-09-26T15:58:45-00:00

Re: [PATCH 1/5] The config option itself
type: item
description: On Wed, 26 Sep 2007 19:43:28 +0400 Pavel Emelyanov wrote: > The option is called NAMESPACES. It can be selectable only > if EMBEDDED is chosen (this was Eric's requisition). When > the EMBEDDED is off namespaces will be on automatically. and when EMBEDDED is on, namespaces will be off automatically, until it is enabled? Is that what you want? (It's OK by me.) Same way for NAMESPACES_EXPERIMENTAL. > One more option (NAMESPACES_EXPERIMENTAL) was added by > Serge's request to move there all the namespaces that are > not finished yet. Currently only the user and the network > namespaces are such. > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> > > --- > > diff --git a/init/Kconfig b/init/Kconfig > index 684ccfb..05a71d7 100644 > --- a/init/Kconfig > +++ b/init/Kconfig > @@ -369,6 +360,23 @@ config RELAY > > If unsure, say N. > > +config NAMESPACES > + bool "The namespaces support" if EMBEDDED bool "Namespaces support" if EMBEDDED > + default !EMBEDDED > + help > + Provides the way to make tasks work with different objects using > + the same id. For example same IPC id may refer to different objects > + or same user id or pid may refer to different tasks when used in > + different namespaces. > + > +config NAMESPACES_EXPERIMENTAL > + bool "Add the experimantal namespaces support" if EMBEDDED experimental > + depends on NAMESPACES && EXPERIMENTAL > + default !EMBEDDED > + help > + Also include the support for the namespaces that are not fnished > + or well developed yet > + > config BLK_DEV_INITRD > bool "Initial RAM filesystem and RAM disk (initramfs/initrd) support" > depends on BROKEN || !FRV > - --- ~Randy Phaedrus says that Quality is about caring. _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: Randy Dunlap
date: 2007-09-26T16:30:28-00:00

Re: [PATCH 1/5] The config option itself
type: item
description: Quoting Pavel Emelyanov (xemul@openvz.org): > The option is called NAMESPACES. It can be selectable only > if EMBEDDED is chosen (this was Eric's requisition). When > the EMBEDDED is off namespaces will be on automatically. > > One more option (NAMESPACES_EXPERIMENTAL) was added by > Serge's request to move there all the namespaces that are > not finished yet. Currently only the user and the network > namespaces are such. > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> > > --- > > diff --git a/init/Kconfig b/init/Kconfig > index 684ccfb..05a71d7 100644 > --- a/init/Kconfig > +++ b/init/Kconfig > @@ -369,6 +360,23 @@ config RELAY > > If unsure, say N. > > +config NAMESPACES > + bool "The namespaces support" if EMBEDDED > + default !EMBEDDED > + help > + Provides the way to make tasks work with different objects using > + the same id. For example same IPC id may refer to different objects > + or same user id or pid may refer to different tasks when used in > + different namespaces. > + > +config NAMESPACES_EXPERIMENTAL > + bool "Add the experimantal namespaces support" if EMBEDDED Hi Pavel, Overall this patchset looks good. However the NAMESPACES_EXPERIMENTAL option should not have the 'if EMBEDDED', right? This is about EXPERIMENTAL, not about EMBEDDED, unlike the plain NAMESPACES option. -serge > + depends on NAMESPACES && EXPERIMENTAL > + default !EMBEDDED > + help > + Also include the support for the namespaces that are not fnished > + or well developed yet > + > config BLK_DEV_INITRD > bool "Initial RAM filesystem and RAM disk (initramfs/initrd) support" > depends on BROKEN || !FRV _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: serue
date: 2007-09-26T16:34:32-00:00

Re: [PATCH 1/5] The config option itself
type: item
description: Quoting Serge E. Hallyn (serue@us.ibm.com): > Quoting Pavel Emelyanov (xemul@openvz.org): > > The option is called NAMESPACES. It can be selectable only > > if EMBEDDED is chosen (this was Eric's requisition). When > > the EMBEDDED is off namespaces will be on automatically. > > > > One more option (NAMESPACES_EXPERIMENTAL) was added by > > Serge's request to move there all the namespaces that are > > not finished yet. Currently only the user and the network > > namespaces are such. > > > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> > > > > --- > > > > diff --git a/init/Kconfig b/init/Kconfig > > index 684ccfb..05a71d7 100644 > > --- a/init/Kconfig > > +++ b/init/Kconfig > > @@ -369,6 +360,23 @@ config RELAY > > > > If unsure, say N. > > > > +config NAMESPACES > > + bool "The namespaces support" if EMBEDDED > > + default !EMBEDDED > > + help > > + Provides the way to make tasks work with different objects using > > + the same id. For example same IPC id may refer to different objects > > + or same user id or pid may refer to different tasks when used in > > + different namespaces. > > + > > +config NAMESPACES_EXPERIMENTAL > > + bool "Add the experimantal namespaces support" if EMBEDDED > > Hi Pavel, > > Overall this patchset looks good. > > However the NAMESPACES_EXPERIMENTAL option should not have the > 'if EMBEDDED', right? This is about EXPERIMENTAL, not about > EMBEDDED, unlike the plain NAMESPACES option. > > -serge Actually that doesn't seem to work either. Even though SECURITY_NAMESPACES=y, the config system seems to infer that since NAMESPACES is not user-selectable, NAMESPACES_EXPERIMENTAL shouldn't be either. So we end up with NAMESPACES_EXPERIMENTAL being on and not un-selectable if !EMBEDDED. > > + depends on NAMESPACES && EXPERIMENTAL > > + default !EMBEDDED > > + help > > + Also include the support for the namespaces that are not fnished > > + or well developed yet > > + > > config BLK_DEV_INITRD > > bool "Initial RAM filesystem and RAM disk (in…
creator: serue
date: 2007-09-26T17:06:21-00:00

Re: [PATCH 1/5] The config option itself
type: item
description: Serge E. Hallyn [serue@us.ibm.com] wrote: | Quoting Serge E. Hallyn (serue@us.ibm.com): | > Quoting Pavel Emelyanov (xemul@openvz.org): | > > The option is called NAMESPACES. It can be selectable only | > > if EMBEDDED is chosen (this was Eric's requisition). When | > > the EMBEDDED is off namespaces will be on automatically. | > > | > > One more option (NAMESPACES_EXPERIMENTAL) was added by | > > Serge's request to move there all the namespaces that are | > > not finished yet. Currently only the user and the network | > > namespaces are such. | > > | > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> | > > | > > --- | > > | > > diff --git a/init/Kconfig b/init/Kconfig | > > index 684ccfb..05a71d7 100644 | > > --- a/init/Kconfig | > > +++ b/init/Kconfig | > > @@ -369,6 +360,23 @@ config RELAY | > > | > > If unsure, say N. | > > | > > +config NAMESPACES | > > + bool "The namespaces support" if EMBEDDED | > > + default !EMBEDDED | > > + help | > > + Provides the way to make tasks work with different objects using | > > + the same id. For example same IPC id may refer to different objects | > > + or same user id or pid may refer to different tasks when used in | > > + different namespaces. | > > + | > > +config NAMESPACES_EXPERIMENTAL | > > + bool "Add the experimantal namespaces support" if EMBEDDED | > | > Hi Pavel, | > | > Overall this patchset looks good. | > | > However the NAMESPACES_EXPERIMENTAL option should not have the | > 'if EMBEDDED', right? This is about EXPERIMENTAL, not about | > EMBEDDED, unlike the plain NAMESPACES option. | > | > -serge | | Actually that doesn't seem to work either. Even though | SECURITY_NAMESPACES=y, the config system seems to infer that | since NAMESPACES is not user-selectable, NAMESPACES_EXPERIMENTAL | shouldn't be either. So we end up with NAMESPACES_EXPERIMENTAL | being on and not un-selectable if !EMBEDDED. Yes. Given that NAMESPACES depends on EMBEDDED, NAMESPACES_EXPERIMENTAL can simply depend on NAMESPACES and EXPERIMEN…
creator: Sukadev Bhattiprolu
date: 2007-09-27T02:30:24-00:00

Re: [PATCH 1/5] The config option itself
type: item
description: sukadev@us.ibm.com wrote: > Serge E. Hallyn [serue@us.ibm.com] wrote: > | Quoting Serge E. Hallyn (serue@us.ibm.com): > | > Quoting Pavel Emelyanov (xemul@openvz.org): > | > > The option is called NAMESPACES. It can be selectable only > | > > if EMBEDDED is chosen (this was Eric's requisition). When > | > > the EMBEDDED is off namespaces will be on automatically. > | > > > | > > One more option (NAMESPACES_EXPERIMENTAL) was added by > | > > Serge's request to move there all the namespaces that are > | > > not finished yet. Currently only the user and the network > | > > namespaces are such. > | > > > | > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> > | > > > | > > --- > | > > > | > > diff --git a/init/Kconfig b/init/Kconfig > | > > index 684ccfb..05a71d7 100644 > | > > --- a/init/Kconfig > | > > +++ b/init/Kconfig > | > > @@ -369,6 +360,23 @@ config RELAY > | > > > | > > If unsure, say N. > | > > > | > > +config NAMESPACES > | > > + bool "The namespaces support" if EMBEDDED > | > > + default !EMBEDDED > | > > + help > | > > + Provides the way to make tasks work with different objects using > | > > + the same id. For example same IPC id may refer to different objects > | > > + or same user id or pid may refer to different tasks when used in > | > > + different namespaces. > | > > + > | > > +config NAMESPACES_EXPERIMENTAL > | > > + bool "Add the experimantal namespaces support" if EMBEDDED > | > > | > Hi Pavel, > | > > | > Overall this patchset looks good. > | > > | > However the NAMESPACES_EXPERIMENTAL option should not have the > | > 'if EMBEDDED', right? This is about EXPERIMENTAL, not about > | > EMBEDDED, unlike the plain NAMESPACES option. > | > > | > -serge > | > | Actually that doesn't seem to work either. Even though > | SECURITY_NAMESPACES=y, the config system seems to infer that > | since NAMESPACES is not user-selectable, NAMESPACES_EXPERIMENTAL > | shouldn't be either. So we end up with NAMESPACES_EXPERIMENTAL > | being on and not un-selectable if …
creator: Pavel Emelianov
date: 2007-09-27T08:22:03-00:00

Re: [PATCH 1/5] The config option itself
type: item
description: Pavel Emelyanov wrote: > The option is called NAMESPACES. It can be selectable only > if EMBEDDED is chosen (this was Eric's requisition). When > the EMBEDDED is off namespaces will be on automatically. > > One more option (NAMESPACES_EXPERIMENTAL) was added by > Serge's request to move there all the namespaces that are > not finished yet. Currently only the user and the network > namespaces are such. > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: Cedric Le Goater <clg@fr.ibm.com> Thanks ! C. > > --- > > diff --git a/init/Kconfig b/init/Kconfig > index 684ccfb..05a71d7 100644 > --- a/init/Kconfig > +++ b/init/Kconfig > @@ -369,6 +360,23 @@ config RELAY > > If unsure, say N. > > +config NAMESPACES > + bool "The namespaces support" if EMBEDDED > + default !EMBEDDED > + help > + Provides the way to make tasks work with different objects using > + the same id. For example same IPC id may refer to different objects > + or same user id or pid may refer to different tasks when used in > + different namespaces. > + > +config NAMESPACES_EXPERIMENTAL > + bool "Add the experimantal namespaces support" if EMBEDDED > + depends on NAMESPACES && EXPERIMENTAL > + default !EMBEDDED > + help > + Also include the support for the namespaces that are not fnished > + or well developed yet > + > config BLK_DEV_INITRD > bool "Initial RAM filesystem and RAM disk (initramfs/initrd) support" > depends on BROKEN || !FRV > _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: Cedric Le Goater
date: 2007-09-27T12:28:31-00:00

Re: [PATCH 2/5] Move the UST namespace under the option
type: item
description: Pavel Emelyanov wrote: > Currently all the namespace management code is in the > kernel/utsname.c file, so just compile it out and make > stub in .h file. > > The init namespace itself is in init/version.c and is > left in the kernel. > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: Cedric Le Goater <clg@fr.ibm.com> Thanks ! C. > > --- > > diff --git a/include/linux/utsname.h b/include/linux/utsname.h > index 923db99..52b9116 100644 > --- a/include/linux/utsname.h > +++ b/include/linux/utsname.h > @@ -35,6 +35,7 @@ struct new_utsname { > #include <linux/sched.h> > #include <linux/kref.h> > #include <linux/nsproxy.h> > +#include <linux/err.h> > #include <asm/atomic.h> > > struct uts_namespace { > @@ -43,6 +44,7 @@ struct uts_namespace { > }; > extern struct uts_namespace init_uts_ns; > > +#ifdef CONFIG_NAMESPACES > static inline void get_uts_ns(struct uts_namespace *ns) > { > kref_get(&ns->kref); > @@ -56,6 +58,25 @@ static inline void put_uts_ns(struct uts > { > kref_put(&ns->kref, free_uts_ns); > } > +#else > +static inline void get_uts_ns(struct uts_namespace *ns) > +{ > +} > + > +static inline void put_uts_ns(struct uts_namespace *ns) > +{ > +} > + > +static inline struct uts_namespace *copy_utsname(unsigned long flags, > + struct uts_namespace *ns) > +{ > + if (flags & CLONE_NEWUTS) > + return ERR_PTR(-EINVAL); > + > + return ns; > +} > +#endif > + > static inline struct new_utsname *utsname(void) > { > return &current->nsproxy->uts_ns->name; > diff --git a/kernel/Makefile b/kernel/Makefile > index 76f782f..5817bfe 100644 > --- a/kernel/Makefile > +++ b/kernel/Makefile > @@ -4,8 +4,7 @@ > signal.o sys.o kmod.o workqueue.o pid.o \ > rcupdate.o extable.o params.o posix-timers.o \ > kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o mutex.o \ > - hrtimer.o rwsem.o latency.o nsproxy.o srcu.o \ > - utsname.o notifier.o sysctl.o > + hrtimer.o rwsem.o latency.o nsproxy.o srcu.o notifier.o sysctl.o > > obj-$(CONFIG_SYSCTL) += sysctl_check.o > obj-$(CONF…
creator: Cedric Le Goater
date: 2007-09-27T12:29:33-00:00

Re: [PATCH 4/5] Move the user namespace under the option
type: item
description: Pavel Emelyanov wrote: > We currently have a CONFIG_USER_NS option. Just rename it > into CONFIG_NAMESPACES_EXPERIMANTAL and move the init_user_ns > into user.c file to make the kernel compile and work without > the namespaces support. > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: Cedric Le Goater <clg@fr.ibm.com> Thanks ! C. > --- > > diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h > index b5f41d4..dda160c 100644 > --- a/include/linux/user_namespace.h > +++ b/include/linux/user_namespace.h > @@ -17,7 +17,7 @@ struct user_namespace { > > extern struct user_namespace init_user_ns; > > -#ifdef CONFIG_USER_NS > +#ifdef CONFIG_NAMESPACES_EXPERIMENTAL > > static inline struct user_namespace *get_user_ns(struct user_namespace *ns) > { > diff --git a/init/Kconfig b/init/Kconfig > index 684ccfb..0db1c3b 100644 > --- a/init/Kconfig > +++ b/init/Kconfig > @@ -206,15 +206,6 @@ config TASK_IO_ACCOUNTING > > Say N if unsure. > > -config USER_NS > - bool "User Namespaces (EXPERIMENTAL)" > - default n > - depends on EXPERIMENTAL > - help > - Support user namespaces. This allows containers, i.e. > - vservers, to use user namespaces to provide different > - user info for different servers. If unsure, say N. > - > config AUDIT > bool "Auditing support" > depends on NET > diff --git a/kernel/Makefile b/kernel/Makefile > index 76f782f..5817bfe 100644 > --- a/kernel/Makefile > +++ b/kernel/Makefile > @@ -4,7 +4,7 @@ > > obj-y = sched.o fork.o exec_domain.o panic.o printk.o profile.o \ > exit.o itimer.o time.o softirq.o resource.o \ > - sysctl.o capability.o ptrace.o timer.o user.o user_namespace.o \ > + sysctl.o capability.o ptrace.o timer.o user.o \ > signal.o sys.o kmod.o workqueue.o pid.o \ > rcupdate.o extable.o params.o posix-timers.o \ > kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o mutex.o \ > @@ -50,6 +49,7 @@ obj-$(CONFIG_AUDITSYSCALL) += auditsc.o > obj-$(CONFIG_KPROBES) += kprobes.o > obj-$(CONFIG_KGDB) += kgdb.o > obj-$(C…
creator: Cedric Le Goater
date: 2007-09-27T12:31:32-00:00

Re: [PATCH 3/5] Move the IPC namespace under the option
type: item
description: Pavel Emelyanov wrote: > Currently all the IPC namespace management code is in > ipc/util.c. I moved this code into ipc/namespace.c file > which is compiled out when needed. > > The linux/ipc_namespace.h file is used to store the > prototypes of the functions in namespace.c and the stubs > for NAMESPACES=n case. This is done so, because the stub > for copy_ipc_namespace requires the knoweledge of the > CLONE_NEWIPC flag, which is in sched.h. But the linux/ipc.h > file itself in included into many many .c files via the > sys.h->sem.h sequence so adding the sched.h into it will > make all these .c depend on sched.h which is not that good. > On the other hand the knowledge about the namespaces stuff > is required in 4 .c files only. > > Besides, this patch compiles out some auxiliary functions > from ipc/sem.c, msg.c and shm.c files. > > Signied-off-by: Pavel Emelyanov <xemul@openvz.org> ^ that sounds french :) Also, for the code aesthetic, I think that ipc/ipc_namespace.c is a better name which fits the header file ipc/ipc_namespace.h. I'm wondering if it possible to move the init routines : #ifdef CONFIG_NAMESPACES int {msg,sem,shm}_init_ns(struct ipc_namespace *ns) { ... } #endif from the ipc/{msg,sem,shm}.c file to the ipc/ipc_namespace.c file. It would look better in the code than using ugly #ifdef. Thanks ! C. > > --- > > diff --git a/include/linux/ipc.h b/include/linux/ipc.h > index 96988d1..b882610 100644 > --- a/include/linux/ipc.h > +++ b/include/linux/ipc.h > @@ -100,56 +100,6 @@ struct kern_ipc_perm > void *security; > }; > > -struct ipc_ids; > -struct ipc_namespace { > - struct kref kref; > - struct ipc_ids *ids[3]; > - > - int sem_ctls[4]; > - int used_sems; > - > - int msg_ctlmax; > - int msg_ctlmnb; > - int msg_ctlmni; > - > - size_t shm_ctlmax; > - size_t shm_ctlall; > - int shm_ctlmni; > - int shm_tot; > -}; > - > -extern struct ipc_namespace init_ipc_ns; > - > -#ifdef CONFIG_SYSVIPC > -#define INIT_IPC_NS(ns) .ns = &init_ipc_ns, > -extern void free_i…
creator: Cedric Le Goater
date: 2007-09-27T12:38:51-00:00

Re: [PATCH 4/5] Move the user namespace under the option
type: item
description: On Thu, 27 Sep 2007, Cedric Le Goater wrote: > > diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h > > index b5f41d4..dda160c 100644 > > --- a/include/linux/user_namespace.h > > +++ b/include/linux/user_namespace.h > > @@ -17,7 +17,7 @@ struct user_namespace { > > > > extern struct user_namespace init_user_ns; > > > > -#ifdef CONFIG_USER_NS > > +#ifdef CONFIG_NAMESPACES_EXPERIMENTAL is it really a good precedent to introduce Kconfig variables that literally include the word "EXPERIMENTAL"? rday -- ======================================================================== Robert P. J. Day Linux Consulting, Training and Annoying Kernel Pedantry Waterloo, Ontario, CANADA http://crashcourse.ca ======================================================================== _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: rpjday
date: 2007-09-27T12:38:54-00:00

Re: [PATCH 3/5] Move the IPC namespace under the option
type: item
description: Cedric Le Goater wrote: > Pavel Emelyanov wrote: >> Currently all the IPC namespace management code is in >> ipc/util.c. I moved this code into ipc/namespace.c file >> which is compiled out when needed. >> >> The linux/ipc_namespace.h file is used to store the >> prototypes of the functions in namespace.c and the stubs >> for NAMESPACES=n case. This is done so, because the stub >> for copy_ipc_namespace requires the knoweledge of the >> CLONE_NEWIPC flag, which is in sched.h. But the linux/ipc.h >> file itself in included into many many .c files via the >> sys.h->sem.h sequence so adding the sched.h into it will >> make all these .c depend on sched.h which is not that good. >> On the other hand the knowledge about the namespaces stuff >> is required in 4 .c files only. >> >> Besides, this patch compiles out some auxiliary functions >> from ipc/sem.c, msg.c and shm.c files. >> >> Signied-off-by: Pavel Emelyanov <xemul@openvz.org> > ^ > that sounds french :) :) > Also, for the code aesthetic, > > I think that ipc/ipc_namespace.c is a better name which fits > the header file ipc/ipc_namespace.h. Well, it already resides in ipc/ directory. I think it's a mess to add one more ipc_ prefix. > I'm wondering if it possible to move the init routines : > > #ifdef CONFIG_NAMESPACES > int {msg,sem,shm}_init_ns(struct ipc_namespace *ns) > { > ... > } > #endif > > from the ipc/{msg,sem,shm}.c file to the ipc/ipc_namespace.c file. > It would look better in the code than using ugly #ifdef. Hm... Looks like it is. I will remake the patches. > Thanks ! > > C. > >> --- >> >> diff --git a/include/linux/ipc.h b/include/linux/ipc.h >> index 96988d1..b882610 100644 >> --- a/include/linux/ipc.h >> +++ b/include/linux/ipc.h >> @@ -100,56 +100,6 @@ struct kern_ipc_perm >> void *security; >> }; >> >> -struct ipc_ids; >> -struct ipc_namespace { >> - struct kref kref; >> - struct ipc_ids *ids[3]; >> - >> - int sem_ctls[4]; >> - int used_sems; >> - >> - int msg_ctlmax; >> - int msg_ctlmnb; >> - i…
creator: Pavel Emelianov
date: 2007-10-01T07:52:53-00:00

Re: [PATCH 4/5] Move the user namespace under the option
type: item
description: Robert P. J. Day wrote: > On Thu, 27 Sep 2007, Cedric Le Goater wrote: > >>> diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h >>> index b5f41d4..dda160c 100644 >>> --- a/include/linux/user_namespace.h >>> +++ b/include/linux/user_namespace.h >>> @@ -17,7 +17,7 @@ struct user_namespace { >>> >>> extern struct user_namespace init_user_ns; >>> >>> -#ifdef CONFIG_USER_NS >>> +#ifdef CONFIG_NAMESPACES_EXPERIMENTAL > > is it really a good precedent to introduce Kconfig variables that > literally include the word "EXPERIMENTAL"? How else can we call it? I proposed one config option for each namespace with "depends on EXPERIMENTAL" dependency, but everyone else said that two options are much better. > rday _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: Pavel Emelianov
date: 2007-10-01T07:54:45-00:00

Re: [PATCH 4/5] Move the user namespace under the option
type: item
description: On Mon, 1 Oct 2007, Pavel Emelyanov wrote: > Robert P. J. Day wrote: > > On Thu, 27 Sep 2007, Cedric Le Goater wrote: > > > >>> diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h > >>> index b5f41d4..dda160c 100644 > >>> --- a/include/linux/user_namespace.h > >>> +++ b/include/linux/user_namespace.h > >>> @@ -17,7 +17,7 @@ struct user_namespace { > >>> > >>> extern struct user_namespace init_user_ns; > >>> > >>> -#ifdef CONFIG_USER_NS > >>> +#ifdef CONFIG_NAMESPACES_EXPERIMENTAL > > > > is it really a good precedent to introduce Kconfig variables that > > literally include the word "EXPERIMENTAL"? > > How else can we call it? I proposed one config option for each > namespace with "depends on EXPERIMENTAL" dependency, but everyone > else said that two options are much better. i don't know -- perhaps something as trivially obvious as NAMESPACES_V2 or something. i just think it's awkward to take a word like "EXPERIMENTAL" that already has a long and established history, and start jamming it into config variable names. but it's just an observation. rday -- ======================================================================== Robert P. J. Day Linux Consulting, Training and Annoying Kernel Pedantry Waterloo, Ontario, CANADA http://crashcourse.ca ======================================================================== _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: rpjday
date: 2007-10-01T08:42:18-00:00

Re: [PATCH 4/5] Move the user namespace under the option
type: item
description: Quoting Robert P. J. Day (rpjday@mindspring.com): > On Mon, 1 Oct 2007, Pavel Emelyanov wrote: > > > Robert P. J. Day wrote: > > > On Thu, 27 Sep 2007, Cedric Le Goater wrote: > > > > > >>> diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h > > >>> index b5f41d4..dda160c 100644 > > >>> --- a/include/linux/user_namespace.h > > >>> +++ b/include/linux/user_namespace.h > > >>> @@ -17,7 +17,7 @@ struct user_namespace { > > >>> > > >>> extern struct user_namespace init_user_ns; > > >>> > > >>> -#ifdef CONFIG_USER_NS > > >>> +#ifdef CONFIG_NAMESPACES_EXPERIMENTAL > > > > > > is it really a good precedent to introduce Kconfig variables that > > > literally include the word "EXPERIMENTAL"? > > > > How else can we call it? I proposed one config option for each > > namespace with "depends on EXPERIMENTAL" dependency, but everyone > > else said that two options are much better. > > i don't know -- perhaps something as trivially obvious as > NAMESPACES_V2 or something. i just think it's awkward to take a word > like "EXPERIMENTAL" that already has a long and established history, > and start jamming it into config variable names. but it's just an > observation. But these really are EXPERIMENTAL, not just 'v2'. They are not yet safe to use except for testing. Once they are more complete and safe to use, they will fall under just CONFIG_NAMESPACES. -serge _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: serue
date: 2007-10-01T14:14:26-00:00

Re: [PATCH 1/5] The config option itself
type: item
description: Quoting Pavel Emelyanov (xemul@openvz.org): > sukadev@us.ibm.com wrote: > > Serge E. Hallyn [serue@us.ibm.com] wrote: > > | Quoting Serge E. Hallyn (serue@us.ibm.com): > > | > Quoting Pavel Emelyanov (xemul@openvz.org): > > | > > The option is called NAMESPACES. It can be selectable only > > | > > if EMBEDDED is chosen (this was Eric's requisition). When > > | > > the EMBEDDED is off namespaces will be on automatically. > > | > > > > | > > One more option (NAMESPACES_EXPERIMENTAL) was added by > > | > > Serge's request to move there all the namespaces that are > > | > > not finished yet. Currently only the user and the network > > | > > namespaces are such. > > | > > > > | > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> > > | > > > > | > > --- > > | > > > > | > > diff --git a/init/Kconfig b/init/Kconfig > > | > > index 684ccfb..05a71d7 100644 > > | > > --- a/init/Kconfig > > | > > +++ b/init/Kconfig > > | > > @@ -369,6 +360,23 @@ config RELAY > > | > > > > | > > If unsure, say N. > > | > > > > | > > +config NAMESPACES > > | > > + bool "The namespaces support" if EMBEDDED > > | > > + default !EMBEDDED > > | > > + help > > | > > + Provides the way to make tasks work with different objects using > > | > > + the same id. For example same IPC id may refer to different objects > > | > > + or same user id or pid may refer to different tasks when used in > > | > > + different namespaces. > > | > > + > > | > > +config NAMESPACES_EXPERIMENTAL > > | > > + bool "Add the experimantal namespaces support" if EMBEDDED > > | > > > | > Hi Pavel, > > | > > > | > Overall this patchset looks good. > > | > > > | > However the NAMESPACES_EXPERIMENTAL option should not have the > > | > 'if EMBEDDED', right? This is about EXPERIMENTAL, not about > > | > EMBEDDED, unlike the plain NAMESPACES option. > > | > > > | > -serge > > | > > | Actually that doesn't seem to work either. Even though > > | SECURITY_NAMESPACES=y, the config system seems to infer that > > | since NAMESPACES is not us…
creator: serue
date: 2007-10-01T14:27:41-00:00

Re: [PATCH 1/5] The config option itself
type: item
description: Serge E. Hallyn wrote: > Quoting Pavel Emelyanov (xemul@openvz.org): >> sukadev@us.ibm.com wrote: >>> Serge E. Hallyn [serue@us.ibm.com] wrote: >>> | Quoting Serge E. Hallyn (serue@us.ibm.com): >>> | > Quoting Pavel Emelyanov (xemul@openvz.org): >>> | > > The option is called NAMESPACES. It can be selectable only >>> | > > if EMBEDDED is chosen (this was Eric's requisition). When >>> | > > the EMBEDDED is off namespaces will be on automatically. >>> | > > >>> | > > One more option (NAMESPACES_EXPERIMENTAL) was added by >>> | > > Serge's request to move there all the namespaces that are >>> | > > not finished yet. Currently only the user and the network >>> | > > namespaces are such. >>> | > > >>> | > > Signed-off-by: Pavel Emelyanov <xemul@openvz.org> >>> | > > >>> | > > --- >>> | > > >>> | > > diff --git a/init/Kconfig b/init/Kconfig >>> | > > index 684ccfb..05a71d7 100644 >>> | > > --- a/init/Kconfig >>> | > > +++ b/init/Kconfig >>> | > > @@ -369,6 +360,23 @@ config RELAY >>> | > > >>> | > > If unsure, say N. >>> | > > >>> | > > +config NAMESPACES >>> | > > + bool "The namespaces support" if EMBEDDED >>> | > > + default !EMBEDDED >>> | > > + help >>> | > > + Provides the way to make tasks work with different objects using >>> | > > + the same id. For example same IPC id may refer to different objects >>> | > > + or same user id or pid may refer to different tasks when used in >>> | > > + different namespaces. >>> | > > + >>> | > > +config NAMESPACES_EXPERIMENTAL >>> | > > + bool "Add the experimantal namespaces support" if EMBEDDED >>> | > >>> | > Hi Pavel, >>> | > >>> | > Overall this patchset looks good. >>> | > >>> | > However the NAMESPACES_EXPERIMENTAL option should not have the >>> | > 'if EMBEDDED', right? This is about EXPERIMENTAL, not about >>> | > EMBEDDED, unlike the plain NAMESPACES option. >>> | > >>> | > -serge >>> | >>> | Actually that doesn't seem to work either. Even though >>> | SECURITY_NAMESPACES=y, the config system seems to infer that >>> | …
creator: Pavel Emelianov
date: 2007-10-01T14:28:51-00:00