OpenVZ Forum: Devel » [PATCH] allow a task to join a pid namespace

Home » Mailing lists » Devel » [PATCH] allow a task to join a pid namespace

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

Re: [PATCH] allow a task to join a pid namespace [message #46721 is a reply to message #46685]

Tue, 05 June 2012 17:18

ebiederm
Messages: 1354
Registered: February 2006

Senior Member

Oleg Nesterov <oleg@redhat.com> writes:

> On 06/04, Glauber Costa wrote:
>>
>> Currently, it is possible for a process to join existing
>> net, uts and ipc namespaces. This patch allows a process to join an
>> existing pid namespace as well.
>
> I can't understand this patch... but probably I missed something,
> I never really understood setns.

The idea with setns is akin to callusermodehelper in the kernel.

>From outside a container we want to allow an appropriately privileged
user to create a process inside the container.

We run into all kinds of interesting gotchas with entering the
pid namespace:
- Disjoint process trees.
- Ensuring all processes are gone when we exit a pid namespace.
- Not letting an empty pid namespace accept more processes.

We really only have two possbilities here.
- Allocate a new struct pid that is a superset of our current struct
pid but having additional processes ids inside a new pid namespace.

Along with all of the appropriate sanity checks to make that safe.

- Just modify the pid namespace the child processes of setns will use.

I lean towards the second option as that seems to have the best semantic
match to practical applications, and fewer kernel races to contend with,
but I might be persuadable.

However we do this we need to fix the bugs in pid namespace cleanup,
and deal with the issues that disjoint process trees bring to waiting
for all processes in a pid namespace to exit.

Ugh. Getting the waking up of zap_pid_ns_processes right and handling
the reaping of zombines in the cases of disjoint process trees is going
to be interesting.

Eric

Report message to a moderator

[Message index]

		[PATCH] allow a task to join a pid namespace By: Glauber Costa on Mon, 04 June 2012 13:33
		Re: [PATCH] allow a task to join a pid namespace By: Oleg Nesterov on Mon, 04 June 2012 16:51
		Re: [PATCH] allow a task to join a pid namespace By: Daniel Lezcano on Tue, 05 June 2012 09:30
		Re: [PATCH] allow a task to join a pid namespace By: ebiederm on Tue, 05 June 2012 17:18
		Re: [PATCH] allow a task to join a pid namespace By: Daniel Lezcano on Tue, 05 June 2012 09:36
		Re: [PATCH] allow a task to join a pid namespace By: Glauber Costa on Tue, 05 June 2012 09:37
		Re: Re: [PATCH] allow a task to join a pid namespace By: Glauber Costa on Tue, 05 June 2012 10:00
		Re: Re: [PATCH] allow a task to join a pid namespace By: Daniel Lezcano on Tue, 05 June 2012 12:52
		Re: Re: [PATCH] allow a task to join a pid namespace By: Glauber Costa on Tue, 05 June 2012 12:53
		Re: Re: [PATCH] allow a task to join a pid namespace By: Daniel Lezcano on Tue, 05 June 2012 13:18
		Re: Re: [PATCH] allow a task to join a pid namespace By: ebiederm on Tue, 05 June 2012 17:39
		Re: [PATCH] allow a task to join a pid namespace By: Glauber Costa on Tue, 05 June 2012 11:33
		Re: [PATCH] allow a task to join a pid namespace By: ebiederm on Wed, 06 June 2012 18:29
		Re: [PATCH] allow a task to join a pid namespace By: ebiederm on Tue, 05 June 2012 16:49
		Re: [PATCH] allow a task to join a pid namespace By: Glauber Costa on Wed, 06 June 2012 08:54

Previous Topic:	[RFC] connectat() and bindat() system calls
Next Topic:	[PATCH 0/4] kmem memcg proposed core changes

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

] [

]

Current Time: Wed Aug 26 16:22:30 GMT 2026

Total time taken to generate the page: 0.69433 seconds