OpenVZ Forum - RDF feed
type: channel
items: [PATCH 0/3] Sysctl shadow management
items: [PATCH 1/3] The sysctl shadows
items: [PATCH 2/3] Switch UTS namespace to use shadows
items: [PATCH 3/3] Switch IPC namespace to use sysctl shadows
items: Re: [PATCH 0/3] Sysctl shadow management
items: Re: [PATCH 1/3] The sysctl shadows
items: Re: [PATCH 3/3] Switch IPC namespace to use sysctl shadows
items: [PATCH 0/4] Sysctl namespace support
items: [PATCH 1/4] sysctl: Add register_sysctl_paths function
items: [PATCH 2/4] sysctl: Remember the ctl_table we passed to register_sysctl_paths
items: [PATCH 3/4] sysctl: Infrastructure for per namespace sysctls
items: Re: [PATCH 0/4] Sysctl namespace support

[PATCH 0/3] Sysctl shadow management
type: item
description: Hi guys! You all know, that with multiple namespaces we have to take special care about sysctls. E.g. IPC sysctl handlers are equipped with kludges to alter the sysctl parameters of appropriate namespace. The same thing should be done for UTS namespace (but it is not - we have a BUG in mainstream) and (!) for network namespaces. Unlike all the other namespaces, network will have to not just address different variables via same sysctl names, but to have different tables with different sysctl names. E.g. /proc/sys/net/conf have entries for devices, which differ across namespaces. Eric currently have some work done in that directions, I like the approach in general very much, but it looks rather raw (Eric, take this in good part). You know, ifdefs in the middle of the code, explicit references to net namespace and so on and so forth. So here's the RFC for a bit better sysctls shadow management. I will provide 3 patches: 1. the sysctl shadows themselves; 2. using shadows in UTS namespace; 3. using shadows in IPC namespace; If someone want I can send 4. example on how to create a /proc/sys/net/conf/-like structure with different names. Using them in net namespace is already checked (I created sysctl entries with different names), but I don't have any patches against any David's tree yet. If we're OK with this set I will start talking to Andrew and David about who to send these patches to and making shadows for net-related sysctl variables. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: Pavel Emelianov
date: 2007-11-20T11:38:36-00:00

[PATCH 1/3] The sysctl shadows
type: item
description: The sysctl shadow is nothing but a ctl_table_head, that hides behind some other one and which is used in proc_sys_readdir, proc_sys_lookup, etc when scanning through the list of these heads. Each "shadow" carries its own set of ctl_tables that are relevant to this shadow. The appropriate shadow is get via the ->shadow() callback on the head. When putting the shadow back (unuse it) one should work with the shadow->origin head. The API: * register_sysctl_table_shadow: registers the ctl table and tells that is will be shadowed with the specified callback; * create_sysctl_shadow: clones the original head's table and creates a shadow for it. The caller then may move the ctl_table->data pointer on the new (shadow) tables to point to another variables. It may also change names for tables, etc; * free_sysctl_shadow: destroys the shadow. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h index 4f5047d..064f132 100644 --- a/include/linux/sysctl.h +++ b/include/linux/sysctl.h @@ -1057,9 +1057,16 @@ struct ctl_table_header struct list_head ctl_entry; int used; struct completion *unregistering; + struct ctl_table_header *(*shadow)(struct ctl_table_header *); + struct ctl_table_header *origin; }; struct ctl_table_header *register_sysctl_table(struct ctl_table * table); +struct ctl_table_header *register_sysctl_table_shadow(struct ctl_table * table, + struct ctl_table_header *(*shadow)(struct ctl_table_header *)); + +struct ctl_table_header *create_sysctl_shadow(struct ctl_table_header *h); +void free_sysctl_shadow(struct ctl_table_header *h); void unregister_sysctl_table(struct ctl_table_header * table); int sysctl_check_table(struct ctl_table *table); diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 489b0d1..bfea4fa 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1320,6 +1320,9 @@ void sysctl_head_finish(struct ctl_table_header *head) { if (!head) return; + if (head->origin) + head = head->origin; + spin_…
creator: Pavel Emelianov
date: 2007-11-20T11:43:42-00:00

[PATCH 2/3] Switch UTS namespace to use shadows
type: item
description: The uts sysctl table contains two writable fields (domainname and nodename), so split the table into common (read-only) part and writable (shadowed). This fixes the BUG! You may create a namespace and then writing to /proc/sys/hostname will cause an init_uts_ns overwrite. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- diff --git a/include/linux/utsname.h b/include/linux/utsname.h index 923db99..7517b36 100644 --- a/include/linux/utsname.h +++ b/include/linux/utsname.h @@ -40,6 +40,7 @@ struct new_utsname { struct uts_namespace { struct kref kref; struct new_utsname name; + struct ctl_table_header *ctl_header; }; extern struct uts_namespace init_uts_ns; @@ -66,6 +67,9 @@ static inline struct new_utsname *init_utsname(void) return &init_uts_ns.name; } +int clone_uts_sysctl(struct uts_namespace *ns); +void free_uts_sysctl(struct uts_namespace *ns); + extern struct rw_semaphore uts_sem; #endif /* __KERNEL__ */ diff --git a/kernel/utsname.c b/kernel/utsname.c index 816d7b2..22e40bb 100644 --- a/kernel/utsname.c +++ b/kernel/utsname.c @@ -26,13 +26,21 @@ static struct uts_namespace *clone_uts_ns(struct uts_namespace *old_ns) ns = kmalloc(sizeof(struct uts_namespace), GFP_KERNEL); if (!ns) - return ERR_PTR(-ENOMEM); + goto err_alloc; + + if (clone_uts_sysctl(ns)) + goto err_sysctl; down_read(&uts_sem); memcpy(&ns->name, &old_ns->name, sizeof(ns->name)); up_read(&uts_sem); kref_init(&ns->kref); return ns; + +err_sysctl: + kfree(ns); +err_alloc: + return ERR_PTR(-ENOMEM); } /* @@ -62,5 +70,6 @@ void free_uts_ns(struct kref *kref) struct uts_namespace *ns; ns = container_of(kref, struct uts_namespace, kref); + free_uts_sysctl(ns); kfree(ns); } diff --git a/kernel/utsname_sysctl.c b/kernel/utsname_sysctl.c index c76c064..8a06f0b 100644 --- a/kernel/utsname_sysctl.c +++ b/kernel/utsname_sysctl.c @@ -75,6 +75,11 @@ static int sysctl_uts_string(ctl_table *table, int __user *name, int nlen, #define sysctl_uts_string NULL #endif +static struct ctl_table_header *uts_sysctl_sh…
creator: Pavel Emelianov
date: 2007-11-20T11:45:51-00:00

[PATCH 3/3] Switch IPC namespace to use sysctl shadows
type: item
description: The same as with UTS - use the shadows. With this there's no longer need in having kludged ->proc_handler and ->strategy for ctl_tables. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> --- diff --git a/include/linux/ipc.h b/include/linux/ipc.h index 408696e..a9fef83 100644 --- a/include/linux/ipc.h +++ b/include/linux/ipc.h @@ -118,6 +118,8 @@ struct ipc_namespace { size_t shm_ctlall; int shm_ctlmni; int shm_tot; + + struct ctl_table_header *ctl_head; }; extern struct ipc_namespace init_ipc_ns; diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c index 79e24e8..5affdfe 100644 --- a/ipc/ipc_sysctl.c +++ b/ipc/ipc_sysctl.c @@ -15,84 +15,6 @@ #include <linux/sysctl.h> #include <linux/uaccess.h> -static void *get_ipc(ctl_table *table) -{ - char *which = table->data; - struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns; - which = (which - (char *)&init_ipc_ns) + (char *)ipc_ns; - return which; -} - -#ifdef CONFIG_PROC_FS -static int proc_ipc_dointvec(ctl_table *table, int write, struct file *filp, - void __user *buffer, size_t *lenp, loff_t *ppos) -{ - struct ctl_table ipc_table; - memcpy(&ipc_table, table, sizeof(ipc_table)); - ipc_table.data = get_ipc(table); - - return proc_dointvec(&ipc_table, write, filp, buffer, lenp, ppos); -} - -static int proc_ipc_doulongvec_minmax(ctl_table *table, int write, - struct file *filp, void __user *buffer, size_t *lenp, loff_t *ppos) -{ - struct ctl_table ipc_table; - memcpy(&ipc_table, table, sizeof(ipc_table)); - ipc_table.data = get_ipc(table); - - return proc_doulongvec_minmax(&ipc_table, write, filp, buffer, - lenp, ppos); -} - -#else -#define proc_ipc_doulongvec_minmax NULL -#define proc_ipc_dointvec NULL -#endif - -#ifdef CONFIG_SYSCTL_SYSCALL -/* The generic sysctl ipc data routine. */ -static int sysctl_ipc_data(ctl_table *table, int __user *name, int nlen, - void __user *oldval, size_t __user *oldlenp, - void __user *newval, size_t newlen) -{ - size_t len; - void *data; - - /* Get out of I don't have a variable */ - if (…
creator: Pavel Emelianov
date: 2007-11-20T11:47:41-00:00

Re: [PATCH 0/3] Sysctl shadow management
type: item
description: Pavel Emelyanov <xemul@openvz.org> writes: > Hi guys! > > You all know, that with multiple namespaces we have to take > special care about sysctls. E.g. IPC sysctl handlers are > equipped with kludges to alter the sysctl parameters of > appropriate namespace. The same thing should be done for UTS > namespace (but it is not - we have a BUG in mainstream) and > (!) for network namespaces. The bug in mainstream was introduced by commit: 7d69a1f4a72b18876c99c697692b78339d491568 Thee code should read: static void *get_uts(ctl_table *table, int write) { char *which = table->data; + struct uts_namespace *uts_ns = current->nsproxy->uts_ns; + which = (which - (char *)&init_uts_ns) + (char *)uts_ns; if (!write) down_read(&uts_sem); else down_write(&uts_sem); return which; } And for 2.6.24 we should just restore the two missing lines. > Unlike all the other namespaces, network will have to not > just address different variables via same sysctl names, but > to have different tables with different sysctl names. E.g. > /proc/sys/net/conf have entries for devices, which differ > across namespaces. > > Eric currently have some work done in that directions, I > like the approach in general very much, but it looks rather > raw (Eric, take this in good part). You know, ifdefs in the > middle of the code, explicit references to net namespace > and so on and so forth. Sure. I don't in principle have any problem with the set of roots we go through be dynamic at run time instead of compile time. That is probably a cleaner approach and likely to solve my problem with sched_debug registering sysctls before the sysctl subsystem is initialized. One direction I have always intended to expand things when there was a bit of time to modify /proc/sys so that it is a symlink to /proc/self/sys. Then make /proc/<pid>/sys have cachable dentries for the sysctls. To achieve that we need to pass our namespaces into your shadow function. Instead of always using current. So I am thinking something like: st…
creator: ebiederm
date: 2007-11-20T13:05:58-00:00

Re: [PATCH 0/3] Sysctl shadow management
type: item
description: Eric W. Biederman wrote: > Pavel Emelyanov <xemul@openvz.org> writes: > >> Hi guys! >> >> You all know, that with multiple namespaces we have to take >> special care about sysctls. E.g. IPC sysctl handlers are >> equipped with kludges to alter the sysctl parameters of >> appropriate namespace. The same thing should be done for UTS >> namespace (but it is not - we have a BUG in mainstream) and >> (!) for network namespaces. > > > The bug in mainstream was introduced by commit: > 7d69a1f4a72b18876c99c697692b78339d491568 > > Thee code should read: > static void *get_uts(ctl_table *table, int write) > { > char *which = table->data; > + struct uts_namespace *uts_ns = current->nsproxy->uts_ns; > + which = (which - (char *)&init_uts_ns) + (char *)uts_ns; > > if (!write) > down_read(&uts_sem); > else > down_write(&uts_sem); > return which; > } > > And for 2.6.24 we should just restore the two missing lines. Yup. I didn't want to submit this set as a fix. On the other hand, I do not quite like the kludges like above... > >> Unlike all the other namespaces, network will have to not >> just address different variables via same sysctl names, but >> to have different tables with different sysctl names. E.g. >> /proc/sys/net/conf have entries for devices, which differ >> across namespaces. >> >> Eric currently have some work done in that directions, I >> like the approach in general very much, but it looks rather >> raw (Eric, take this in good part). You know, ifdefs in the >> middle of the code, explicit references to net namespace >> and so on and so forth. > > Sure. I don't in principle have any problem with the set of > roots we go through be dynamic at run time instead of compile > time. That is probably a cleaner approach and likely to solve > my problem with sched_debug registering sysctls before the > sysctl subsystem is initialized. > > One direction I have always intended to expand things when > there was a bit of time to modify /proc/sys so that it > is a symlink to /…
creator: Pavel Emelianov
date: 2007-11-20T13:21:21-00:00

Re: [PATCH 0/3] Sysctl shadow management
type: item
description: To be very very very clear. This is the way I think we should do the core sysctl infrastructure. On top of the register_sysctl_table patch, getting all of the infrastructure in at once. With a list of lists so we don't kill ourselves when we try to implement sysctls that are per network devices. I'm not yet finished testing and reviewing the code yet but I think this is pretty close. >From 7a0ab8b4d471fb1f2721150a5b1737a6e407b7b8 Mon Sep 17 00:00:00 2001 From: Eric W. Biederman <ebiederm@xmission.com> Date: Tue, 20 Nov 2007 07:51:50 -0700 Subject: [PATCH] sysctl: Infrastructure for per namespace sysctls This patch implements the basic infrastructure for per namespace sysctls. A list of lists of sysctl headers is added, allowing each namespace to have it's own list of sysctl headers. Each list of sysctl headers has a lookup function to find the first sysctl header in the list, allowing the lists to have a per namespace instance. register_sysct_root is added to tell sysctl.c about additional lists of lists. As all of the users are expected to be in kernel no unregister function is provided. sysctl_head_next is updated to walk through the list of lists. __reegister_sysctl_paths is added to add a new sysctl table on a non-default sysctl list. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- include/linux/sysctl.h | 16 ++++++++- kernel/sysctl.c | 92 +++++++++++++++++++++++++++++++++++++++++------- kernel/sysctl_check.c | 25 +++++++------ 3 files changed, 108 insertions(+), 25 deletions(-) diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h index 8b2e9e0..eeea2bb 100644 --- a/include/linux/sysctl.h +++ b/include/linux/sysctl.h @@ -951,7 +951,9 @@ enum /* For the /proc/sys support */ struct ctl_table; +struct nsproxy; extern struct ctl_table_header *sysctl_head_next(struct ctl_table_header *prev); +extern struct ctl_table_header *__sysctl_head_next(struct nsproxy *namespaces, struct ctl_table_header *prev); extern void sysctl_head_finish(struct ctl_tab…
creator: ebiederm
date: 2007-11-20T15:21:06-00:00

Re: [PATCH 0/3] Sysctl shadow management
type: item
description: Eric W. Biederman wrote: > To be very very very clear. > > This is the way I think we should do the core sysctl infrastructure. > > On top of the register_sysctl_table patch, getting all of the > infrastructure in at once. > > With a list of lists so we don't kill ourselves when we try to > implement sysctls that are per network devices. Hm... My patch looks to do very very same thing, but in a bit simpler manner. Except for the absence of the sysctl paths, but they are just cleanups. I think I can port them on top of my shadows :) Thanks > I'm not yet finished testing and reviewing the code yet but I > think this is pretty close. Thanks, Pavel >>From 7a0ab8b4d471fb1f2721150a5b1737a6e407b7b8 Mon Sep 17 00:00:00 2001 > From: Eric W. Biederman <ebiederm@xmission.com> > Date: Tue, 20 Nov 2007 07:51:50 -0700 > Subject: [PATCH] sysctl: Infrastructure for per namespace sysctls > > This patch implements the basic infrastructure for per namespace sysctls. > > A list of lists of sysctl headers is added, allowing each namespace to have > it's own list of sysctl headers. > > Each list of sysctl headers has a lookup function to find the first > sysctl header in the list, allowing the lists to have a per namespace > instance. > > register_sysct_root is added to tell sysctl.c about additional > lists of lists. As all of the users are expected to be in > kernel no unregister function is provided. > > sysctl_head_next is updated to walk through the list of lists. > > __reegister_sysctl_paths is added to add a new sysctl table on > a non-default sysctl list. > > Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> > --- > include/linux/sysctl.h | 16 ++++++++- > kernel/sysctl.c | 92 +++++++++++++++++++++++++++++++++++++++++------- > kernel/sysctl_check.c | 25 +++++++------ > 3 files changed, 108 insertions(+), 25 deletions(-) > > diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h > index 8b2e9e0..eeea2bb 100644 > --- a/include/linux/sysctl.h > +++ b/include/linux/sysctl…
creator: Pavel Emelianov
date: 2007-11-20T15:36:22-00:00

Re: [PATCH 1/3] The sysctl shadows
type: item
description: On Tue, 2007-11-20 at 14:43 +0300, Pavel Emelyanov wrote: > > +static void ctl_free_table(struct ctl_table *t) > +{ > + struct ctl_table *tmp; > + > + for (tmp = t; tmp->ctl_name || tmp->procname; tmp++) > + if (tmp->child) > + ctl_free_table(tmp->child); > + > + kfree(t); > +} Are you worried about the recursion at all? -- Dave _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: Dave Hansen
date: 2007-11-20T17:16:49-00:00

Re: [PATCH 3/3] Switch IPC namespace to use sysctl shadows
type: item
description: On Tue, 2007-11-20 at 14:47 +0300, Pavel Emelyanov wrote: > > > +int ipc_clone_sysctl(struct ipc_namespace *ns) > +{ > + struct ctl_table_header *h; > + struct ctl_table *t; > + > + h = create_sysctl_shadow(init_ipc_ns.ctl_head); > + if (h == NULL) > + return -ENOMEM; > + > + t = h->ctl_table->child; > + > + t[0].data = &ns->shm_ctlmax; > + t[1].data = &ns->shm_ctlall; > + t[2].data = &ns->shm_ctlmni; > + t[3].data = &ns->msg_ctlmax; > + t[4].data = &ns->msg_ctlmni; > + t[5].data = &ns->msg_ctlmnb; > + t[6].data = &ns->sem_ctls; > + > + ns->ctl_head = h; > + return 0; > +} >From where does the order for these things come? -- Dave _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: Dave Hansen
date: 2007-11-20T17:24:13-00:00

Re: [PATCH 0/3] Sysctl shadow management
type: item
description: Pavel Emelyanov <xemul@openvz.org> writes: > Eric W. Biederman wrote: >> To be very very very clear. >> >> This is the way I think we should do the core sysctl infrastructure. >> >> On top of the register_sysctl_table patch, getting all of the >> infrastructure in at once. >> >> With a list of lists so we don't kill ourselves when we try to >> implement sysctls that are per network devices. > > Hm... My patch looks to do very very same thing, but in > a bit simpler manner. Except for the absence of the > sysctl paths, but they are just cleanups. I think I can > port them on top of my shadows :) Thanks Then slow down and listen. Your code simply does not address module unload races. BAD BAD BAD. Your code skips sysctl_check allowing buggy sysctl tables to continue to exist BAD BAD BAD. Your code does not implement a list of lists needed to implement a dynamic list of network devices, instead leaving it to the user of sysctl registration code to do. (Which is where the bulk of your simplicity seems to come from). BAD BAD BAD. So I'm sorry. Your code is simpler because it is WORSE. Your code is race prone, encourages buggy users, and doesn't even solve the same problem. So no I don't think it makes a bit of sense. Eric _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: ebiederm
date: 2007-11-20T19:47:26-00:00

Re: [PATCH 1/3] The sysctl shadows
type: item
description: Dave Hansen wrote: > On Tue, 2007-11-20 at 14:43 +0300, Pavel Emelyanov wrote: >> +static void ctl_free_table(struct ctl_table *t) >> +{ >> + struct ctl_table *tmp; >> + >> + for (tmp = t; tmp->ctl_name || tmp->procname; tmp++) >> + if (tmp->child) >> + ctl_free_table(tmp->child); >> + >> + kfree(t); >> +} > > Are you worried about the recursion at all? I do, but 1. sysctl tables are _never_ deeper than 5 levels (as they _always_ come from the kernel space) 2. registering sysctl tables happens from __init calls usually so the stack is not filled at all 3. after implementing the sysctl paths this will vanish ;) Moreover, this is not the only case of recursion in the kernel :) Thanks, Pavel > -- Dave > > _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: Pavel Emelianov
date: 2007-11-21T09:20:38-00:00

Re: [PATCH 3/3] Switch IPC namespace to use sysctl shadows
type: item
description: Dave Hansen wrote: > On Tue, 2007-11-20 at 14:47 +0300, Pavel Emelyanov wrote: >> >> +int ipc_clone_sysctl(struct ipc_namespace *ns) >> +{ >> + struct ctl_table_header *h; >> + struct ctl_table *t; >> + >> + h = create_sysctl_shadow(init_ipc_ns.ctl_head); >> + if (h == NULL) >> + return -ENOMEM; >> + >> + t = h->ctl_table->child; >> + >> + t[0].data = &ns->shm_ctlmax; >> + t[1].data = &ns->shm_ctlall; >> + t[2].data = &ns->shm_ctlmni; >> + t[3].data = &ns->msg_ctlmax; >> + t[4].data = &ns->msg_ctlmni; >> + t[5].data = &ns->msg_ctlmnb; >> + t[6].data = &ns->sem_ctls; >> + >> + ns->ctl_head = h; >> + return 0; >> +} > >>From where does the order for these things come? >From the original tables. > -- Dave > > _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: Pavel Emelianov
date: 2007-11-21T09:21:06-00:00

Re: [PATCH 0/3] Sysctl shadow management
type: item
description: Eric W. Biederman wrote: > Pavel Emelyanov <xemul@openvz.org> writes: > >> Eric W. Biederman wrote: >>> To be very very very clear. >>> >>> This is the way I think we should do the core sysctl infrastructure. >>> >>> On top of the register_sysctl_table patch, getting all of the >>> infrastructure in at once. >>> >>> With a list of lists so we don't kill ourselves when we try to >>> implement sysctls that are per network devices. >> Hm... My patch looks to do very very same thing, but in >> a bit simpler manner. Except for the absence of the >> sysctl paths, but they are just cleanups. I think I can >> port them on top of my shadows :) Thanks > > Then slow down and listen. Press my ear close to the monitor. > Your code simply does not address module unload races. BAD BAD BAD. Can you unload IPC or UTS module? =) > Your code skips sysctl_check allowing buggy sysctl tables to continue > to exist BAD BAD BAD. The tables are cloned from those who passed these checks. ;) > Your code does not implement a list of lists needed to implement > a dynamic list of network devices, instead leaving it to the user of > sysctl registration code to do. (Which is where the bulk of your > simplicity seems to come from). BAD BAD BAD. Do we need this stuff for IPC? UTS? Stick to the patches please. Network sysctls are more complex, I know it. Multiple shadows per-head are to be done. I agree with that. I'm not trying to create the most generic code that can solve all our needs at once. These patches do not provide any facility to display the information via sysfs. So? Does anybody care about it? I already have a bad experience with sending doing-it-all-in-one-go patches to the community. > So I'm sorry. Your code is simpler because it is WORSE. > > Your code is race prone, encourages buggy users, and doesn't even > solve the same problem. So no I don't think it makes a bit > of sense. I decidedly object against such an outrageous statements. > Eric > Pavel ________________________________…
creator: Pavel Emelianov
date: 2007-11-21T09:52:03-00:00

[PATCH 0/4] Sysctl namespace support
type: item
description: Currently the network namespace work has gotten about as far as we can without the ability to make sysctls that are per network namespace. The techniques we have been using for other namespace of examining current and replacing the ctl_table.data field depending on the namespace instance that current->nsproxy refers to are both ugly and do not work for the network sysctls. The case in handling the networking sysctls that does not work with the existing ugly pointer munging techniques are directories like /proc/sys/net/ipv4/conf/ and /proc/sys/net/ipv4/neigh/ whose contents vary depending on the networking devices present in the network namespace. Adding support to the sysctl infrastructure to allow to register a sysctl table for a particular instance of a particular namespace removes the need for magic sysctl methods, and allows the use of the techniques for managing dynamic sysctl tables used for years in the network stack. Herbert we need this infrastructure most in net-2.6.25 (as not having it is a current bottleneck to further development of the network namespace) so these patches are against net-2.6.25. Andrew also need this infrastructure in -mm so that we can take advantage of this new infrastructure when implementing other namespaces. So I expect the sane way to deal with this patchset is to merge into both net-2.6.25 and -mm and then Andrew can drop or disable the patches once he pulls bases -mm on a version of net-2.6.25 with the changes. Eric _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: ebiederm
date: 2007-11-29T17:40:24-00:00

[PATCH 1/4] sysctl: Add register_sysctl_paths function
type: item
description: There are a number of modules that register a sysctl table somewhere deeply nested in the sysctl hierarchy, such as fs/nfs, fs/xfs, dev/cdrom, etc. They all specify several dummy ctl_tables for the path name. This patch implements register_sysctl_path that takes an additional path name, and makes up dummy sysctl nodes for each component. This patch was originally written by Olaf Kirch and brought to my attention and reworked some by Olaf Hering. I have changed a few additional things so the bugs are mine. After converting all of the easy callers Olaf Hering observed allyesconfig ARCH=i386, the patch reduces the final binary size by 9369 bytes. .text +897 .data -7008 text data bss dec hex filename 26959310 4045899 4718592 35723801 2211a19 ../vmlinux-vanilla 26960207 4038891 4718592 35717690 221023a ../O-allyesconfig/vmlinux So this change is both a space savings and a code simplification. CC: Olaf Kirch <okir@suse.de> CC: Olaf Hering <olaf@aepfle.de> Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- include/linux/sysctl.h | 9 +++++ kernel/sysctl.c | 90 ++++++++++++++++++++++++++++++++++++++++-------- 2 files changed, 84 insertions(+), 15 deletions(-) diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h index e99171f..eb522bf 100644 --- a/include/linux/sysctl.h +++ b/include/linux/sysctl.h @@ -1065,7 +1065,16 @@ struct ctl_table_header struct completion *unregistering; }; +/* struct ctl_path describes where in the hierarchy a table is added */ +struct ctl_path +{ + const char *procname; + int ctl_name; +}; + struct ctl_table_header *register_sysctl_table(struct ctl_table * table); +struct ctl_table_header *register_sysctl_paths(const struct ctl_path *path, + struct ctl_table *table); void unregister_sysctl_table(struct ctl_table_header * table); int sysctl_check_table(struct ctl_table *table); diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 0deed82..fa92e70 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1490,11 +1490,12 @@ static __init…
creator: ebiederm
date: 2007-11-29T17:45:10-00:00

[PATCH 2/4] sysctl: Remember the ctl_table we passed to register_sysctl_paths
type: item
description: By doing this we allow users of register_sysctl_paths that build and dynamically allocate their ctl_table to be simpler. This allows them to just remember the ctl_table_header returned from register_sysctl_paths from which they can now find the ctl_table array they need to free. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- include/linux/sysctl.h | 1 + kernel/sysctl.c | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h index eb522bf..8b2e9e0 100644 --- a/include/linux/sysctl.h +++ b/include/linux/sysctl.h @@ -1063,6 +1063,7 @@ struct ctl_table_header struct list_head ctl_entry; int used; struct completion *unregistering; + struct ctl_table *ctl_table_arg; }; /* struct ctl_path describes where in the hierarchy a table is added */ diff --git a/kernel/sysctl.c b/kernel/sysctl.c index fa92e70..effae87 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1598,6 +1598,7 @@ struct ctl_table_header *register_sysctl_paths(const struct ctl_path *path, new += 2; } *prevp = table; + header->ctl_table_arg = table; INIT_LIST_HEAD(&header->ctl_entry); header->used = 0; -- 1.5.3.rc6.17.g1911 _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: ebiederm
date: 2007-11-29T17:46:26-00:00

[PATCH 3/4] sysctl: Infrastructure for per namespace sysctls
type: item
description: This patch implements the basic infrastructure for per namespace sysctls. A list of lists of sysctl headers is added, allowing each namespace to have it's own list of sysctl headers. Each list of sysctl headers has a lookup function to find the first sysctl header in the list, allowing the lists to have a per namespace instance. register_sysct_root is added to tell sysctl.c about additional lists of sysctl_headers. As all of the users are expected to be in kernel no unregister function is provided. sysctl_head_next is updated to walk through the list of lists. __register_sysctl_paths is added to add a new sysctl table on a non-default sysctl list. The only intrusive part of this patch is propagating the information to decided which list of sysctls to use for sysctl_check_table. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> --- include/linux/sysctl.h | 16 ++++++++- kernel/sysctl.c | 93 ++++++++++++++++++++++++++++++++++++++++++------ kernel/sysctl_check.c | 25 +++++++------ 3 files changed, 111 insertions(+), 23 deletions(-) diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h index 8b2e9e0..cd1da5c 100644 --- a/include/linux/sysctl.h +++ b/include/linux/sysctl.h @@ -951,7 +951,9 @@ enum /* For the /proc/sys support */ struct ctl_table; +struct nsproxy; extern struct ctl_table_header *sysctl_head_next(struct ctl_table_header *prev); +extern struct ctl_table_header *__sysctl_head_next(struct nsproxy *namespaces, struct ctl_table_header *prev); extern void sysctl_head_finish(struct ctl_table_header *prev); extern int sysctl_perm(struct ctl_table *table, int op); @@ -1055,6 +1057,13 @@ struct ctl_table void *extra2; }; +struct ctl_table_root { + struct list_head root_list; + struct list_head header_list; + struct list_head *(*lookup)(struct ctl_table_root *root, + struct nsproxy *namespaces); +}; + /* struct ctl_table_header is used to maintain dynamic lists of struct ctl_table trees. */ struct ctl_table_header @@ -1064,6 +1073,7 @@ struct ctl_table_h…
creator: ebiederm
date: 2007-11-29T17:51:50-00:00

Re: [PATCH 0/4] Sysctl namespace support
type: item
description: On Thu, Nov 29, 2007 at 10:40:24AM -0700, Eric W. Biederman wrote: > > Herbert we need this infrastructure most in net-2.6.25 (as not having > it is a current bottleneck to further development of the network > namespace) so these patches are against net-2.6.25. I've applied them all to net-2.6.25 with Andrew's fixes included. Thanks Eric. -- Visit Openswan at http://www.openswan.org/ Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: Herbert Xu
date: 2007-11-30T12:56:27-00:00

Re: [PATCH 0/4] Sysctl namespace support
type: item
description: Herbert Xu <herbert@gondor.apana.org.au> writes: > On Thu, Nov 29, 2007 at 10:40:24AM -0700, Eric W. Biederman wrote: >> >> Herbert we need this infrastructure most in net-2.6.25 (as not having >> it is a current bottleneck to further development of the network >> namespace) so these patches are against net-2.6.25. > > I've applied them all to net-2.6.25 with Andrew's fixes included. > Thanks Eric. Welcome, and thanks. I will see about taking advantage of this shortly. Eric _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linux-foundation.org/mailman/listinfo/containers
creator: ebiederm
date: 2007-11-30T13:25:25-00:00