Home » Mailing lists » Devel » [patch -mm 00/17] new namespaces and related syscalls
Re: [patch -mm 08/17] nsproxy: add hashtable [message #16920 is a reply to message #16878] |
Mon, 11 December 2006 15:29 ![Go to previous message Go to previous message](/theme/ovz3/images/up.png) ![Go to next message Go to previous message](/theme/ovz3/images/down.png) |
serue
Messages: 750 Registered: February 2006
|
Senior Member |
|
|
Quoting Eric W. Biederman (ebiederm@xmission.com):
> Herbert Poetzl <herbert@13thfloor.at> writes:
>
> >> There are two possible ways.
> >> 1) Just use a process using the namespace.
> >> This is easiest to implement.
> >
> >> 2) Have a struct pid reference in the namespace itself,
> >> and probably an extra pointer in struct pid to find it.
> >> This is the most stable, because fork/exit won't affect
> >> which pid you need to use.
> >
> > that 'can' be an nsproxy or something different, but
> > I'm absolutely unhappy with tying it to a process,
> > as I already mentioned several times, that lightweight
> > 'containers' do not use/have an init process, and no
> > single process might survive the entire life span of
> > that 'container' ...
>
> Herbert think of a session id. That is a pid that is
> tied to something besides a single process.
>
> It is easy and recursion safe to tie a pid to a namespace
> or anything else that make sense, as I suggested above.
Recursion safe, but limiting in that you can only descend one pid
namespace at a time. That limitation aside, providing task
notifiers for all unshares, plus a syscall to jump into all
namespaces belonging to a process known to you by a particular
pid, could be a good approach. Now you can have a userspace
daemon keeping namespace id's tied to processes, giving you the
ability to say
ns_exec -a -I ns12 my_prog
(unshare all namespaces and run my_prog in
a container known as 'ns12')
ns_enter -I ns12 /bin/ps
(jump into ns12 and run /bin/ps)
The likely requirement to run a namespace tracking daemon in
each pid namespace that wants such functionality could become
a resource hog, but that may be just a theoretical problem, since
you'll only need that if you want to play with namespaces,
meaning that for it to be a problem you'd have to have lots of
virtual servers each maintaining namespaces to either do
process migration or spawn more virtual servers (which each
maintain namespaces to...)
> The pid namespace feels like the right place for this kind
> of activity.
>
> >> Beyond that yes it seems to make sense to let user space
> >> maintain any mapping of containers to ids.
> >
> > I agree with that, but we need something to move
> > around between the various spaces ...
>
> If you have CAP_SYS_PTRACE or you have a child process
> in a container you can create another with ptrace.
>
> Now I don't mind optimizing that case, with something like
> the proposed bind_ns syscall. But we need to be darn certain
> why it is safe, and does not change the security model that
> we currently have.
Sigh, and that's going to have to be a discussion per namespace.
> I have not seen that discussion yet, and until I do I have
> serious concerns. That discussion needs to be on lkml as
> well. Why did Al Viro think this was a bad idea when it
> was proposed for the mount namespace?
>
> This is where you are on the edge of some very weird interface
> interactions. Without suid programs it would be completely safe
> for anyone to unshare their mount namespace. With suid programs
> allowed an unprivileged unshare mount namespace unshare is next to
> impossible.
>
> > for example, Linux-VServer ties the namespaces to
> > the context structure (atm) which allows userspace
> > to set and enter specific spaces of a guest context
> > (I assume OpenVZ does similar)
>
> Yep, and we certainly need to find a way to fulfill this usage
> requirement.
_______________________________________________
Containers mailing list
Containers@lists.osdl.org
https://lists.osdl.org/mailman/listinfo/containers
|
|
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 00/17] new namespaces and related syscalls
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 01/17] net namespace: empty framework
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 02/17] user namespace: add the framework
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 03/17] namespace : export unshare of namespace and fs_struct
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 04/17] nsproxy: externalizes exit_task_namespaces
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 04/17] nsproxy: externalizes exit_task_namespaces
By: ebiederm on Fri, 08 December 2006 20:16
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 04/17] nsproxy: externalizes exit_task_namespaces
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 05/17] ipc namespace : externalizes unshare_ipcs
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 05/17] ipc namespace : externalizes unshare_ipcs
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 05/17] ipc namespace : externalizes unshare_ipcs
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 06/17] nsproxy: add extern to nsproxy functions
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 07/17] nsproxy: make put_nsproxy an extern
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Fri, 08 December 2006 19:30
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: serue on Fri, 08 December 2006 19:53
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Fri, 08 December 2006 20:57
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Sat, 09 December 2006 07:54
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: serue on Mon, 11 December 2006 15:29
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: serue on Mon, 11 December 2006 15:56
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Mon, 11 December 2006 19:35
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: serue on Mon, 11 December 2006 20:03
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Mon, 11 December 2006 20:34
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: serue on Mon, 11 December 2006 22:01
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: serue on Wed, 20 December 2006 06:12
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: serue on Mon, 11 December 2006 22:18
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Tue, 12 December 2006 03:28
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: serue on Tue, 12 December 2006 15:29
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: serue on Tue, 12 December 2006 15:45
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: dev on Tue, 12 December 2006 08:43
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Tue, 12 December 2006 07:52
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Tue, 12 December 2006 08:37
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Tue, 12 December 2006 08:57
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Wed, 13 December 2006 18:53
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 08/17] nsproxy: add hashtable
By: ebiederm on Thu, 14 December 2006 21:08
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 09/17] nsproxy: add namespace flags
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 09/17] nsproxy: add namespace flags
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 09/17] nsproxy: add namespace flags
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 09/17] nsproxy: add namespace flags
By: ebiederm on Fri, 08 December 2006 19:40
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 09/17] nsproxy: add namespace flags
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 09/17] nsproxy: add namespace flags
By: ebiederm on Mon, 11 December 2006 20:02
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 10/17] nsproxy: add unshare_ns and bind_ns syscalls
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 10/17] nsproxy: add unshare_ns and bind_ns syscalls
By: ebiederm on Fri, 08 December 2006 19:26
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 10/17] nsproxy: add unshare_ns and bind_ns syscalls
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 10/17] nsproxy: add unshare_ns and bind_ns syscalls
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 10/17] nsproxy: add unshare_ns and bind_ns syscalls
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 10/17] nsproxy: add unshare_ns and bind_ns syscalls
By: ebiederm on Sat, 09 December 2006 07:40
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 10/17] nsproxy: add unshare_ns and bind_ns syscalls
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 11/17] user namespace: add user_namespace ptr to vfsmount
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch -mm 11/17] user namespace: add user_namespace ptr to vfsmount
By: serue on Tue, 05 December 2006 18:27
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 12/17] user namespace: hook permission
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 13/17] user namespace: implement shared mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 14/17] user namespace: maintain user ns for priv_userns mounts to vfsmount
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 15/17] pid namespace: add unshare
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 16/17] net namespace: add unshare
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch -mm 17/17] user namespace: add unshare
|
Goto Forum:
Current Time: Sun Sep 01 09:54:35 GMT 2024
Total time taken to generate the page: 0.06168 seconds
|