by Kirill Tkhai

[permalink] [raw]

Subject: Re: [PATCH 00/23] proc: Introduce /proc/namespaces/ directory to expose namespaces lineary

On 30.07.2020 17:34, Eric W. Biederman wrote:
> Kirill Tkhai <[email protected]> writes:
>
>> Currently, there is no a way to list or iterate all or subset of namespaces
>> in the system. Some namespaces are exposed in /proc/[pid]/ns/ directories,
>> but some also may be as open files, which are not attached to a process.
>> When a namespace open fd is sent over unix socket and then closed, it is
>> impossible to know whether the namespace exists or not.
>>
>> Also, even if namespace is exposed as attached to a process or as open file,
>> iteration over /proc/*/ns/* or /proc/*/fd/* namespaces is not fast, because
>> this multiplies at tasks and fds number.
>
> I am very dubious about this.
>
> I have been avoiding exactly this kind of interface because it can
> create rather fundamental problems with checkpoint restart.

restart/restore :)

> You do have some filtering and the filtering is not based on current.
> Which is good.
>
> A view that is relative to a user namespace might be ok. It almost
> certainly does better as it's own little filesystem than as an extension
> to proc though.
>
> The big thing we want to ensure is that if you migrate you can restore
> everything. I don't see how you will be able to restore these files
> after migration. Anything like this without having a complete
> checkpoint/restore story is a non-starter.

There is no difference between files in /proc/namespaces/ directory and /proc/[pid]/ns/.

CRIU can restore open files in /proc/[pid]/ns, the same will be with /proc/namespaces/ files.
As a person who worked deeply for pid_ns and user_ns support in CRIU, I don't see any
problem here.

If you have a specific worries about, let's discuss them.

CC: Pavel Tikhomirov CRIU maintainer, who knows everything about namespaces C/R.

> Further by not going through the processes it looks like you are
> bypassing the existing permission checks. Which has the potential
> to allow someone to use a namespace who would not be able to otherwise.

I agree, and I wrote to Christian, that permissions should be more strict.
This just should be formalized. Let's discuss this.

> So I think this goes one step too far but I am willing to be persuaded
> otherwise.
>
> Eric
>
>
>
>
>> This patchset introduces a new /proc/namespaces/ directory, which exposes
>> subset of permitted namespaces in linear view:
>>
>> # ls /proc/namespaces/ -l
>> lrwxrwxrwx 1 root root 0 Jul 29 16:50 'cgroup:[4026531835]' -> 'cgroup:[4026531835]'
>> lrwxrwxrwx 1 root root 0 Jul 29 16:50 'ipc:[4026531839]' -> 'ipc:[4026531839]'
>> lrwxrwxrwx 1 root root 0 Jul 29 16:50 'mnt:[4026531840]' -> 'mnt:[4026531840]'
>> lrwxrwxrwx 1 root root 0 Jul 29 16:50 'mnt:[4026531861]' -> 'mnt:[4026531861]'
>> lrwxrwxrwx 1 root root 0 Jul 29 16:50 'mnt:[4026532133]' -> 'mnt:[4026532133]'
>> lrwxrwxrwx 1 root root 0 Jul 29 16:50 'mnt:[4026532134]' -> 'mnt:[4026532134]'
>> lrwxrwxrwx 1 root root 0 Jul 29 16:50 'mnt:[4026532135]' -> 'mnt:[4026532135]'
>> lrwxrwxrwx 1 root root 0 Jul 29 16:50 'mnt:[4026532136]' -> 'mnt:[4026532136]'
>> lrwxrwxrwx 1 root root 0 Jul 29 16:50 'net:[4026531993]' -> 'net:[4026531993]'
>> lrwxrwxrwx 1 root root 0 Jul 29 16:50 'pid:[4026531836]' -> 'pid:[4026531836]'
>> lrwxrwxrwx 1 root root 0 Jul 29 16:50 'time:[4026531834]' -> 'time:[4026531834]'
>> lrwxrwxrwx 1 root root 0 Jul 29 16:50 'user:[4026531837]' -> 'user:[4026531837]'
>> lrwxrwxrwx 1 root root 0 Jul 29 16:50 'uts:[4026531838]' -> 'uts:[4026531838]'
>>
>> Namespace ns is exposed, in case of its user_ns is permitted from /proc's pid_ns.
>> I.e., /proc is related to pid_ns, so in /proc/namespace we show only a ns, which is
>>
>> in_userns(pid_ns->user_ns, ns->user_ns).
>>
>> In case of ns is a user_ns:
>>
>> in_userns(pid_ns->user_ns, ns).
>>
>> The patchset follows this steps:
>>
>> 1)A generic counter in ns_common is introduced instead of separate
>> counters for every ns type (net::count, uts_namespace::kref,
>> user_namespace::count, etc). Patches [1-8];
>> 2)Patch [9] introduces IDR to link and iterate alive namespaces;
>> 3)Patch [10] is refactoring;
>> 4)Patch [11] actually adds /proc/namespace directory and fs methods;
>> 5)Patches [12-23] make every namespace to use the added methods
>> and to appear in /proc/namespace directory.
>>
>> This may be usefull to write effective debug utils (say, fast build
>> of networks topology) and checkpoint/restore software.
>> ---
>>
>> Kirill Tkhai (23):
>> ns: Add common refcount into ns_common add use it as counter for net_ns
>> uts: Use generic ns_common::count
>> ipc: Use generic ns_common::count
>> pid: Use generic ns_common::count
>> user: Use generic ns_common::count
>> mnt: Use generic ns_common::count
>> cgroup: Use generic ns_common::count
>> time: Use generic ns_common::count
>> ns: Introduce ns_idr to be able to iterate all allocated namespaces in the system
>> fs: Rename fs/proc/namespaces.c into fs/proc/task_namespaces.c
>> fs: Add /proc/namespaces/ directory
>> user: Free user_ns one RCU grace period after final counter put
>> user: Add user namespaces into ns_idr
>> net: Add net namespaces into ns_idr
>> pid: Eextract child_reaper check from pidns_for_children_get()
>> proc_ns_operations: Add can_get method
>> pid: Add pid namespaces into ns_idr
>> uts: Free uts namespace one RCU grace period after final counter put
>> uts: Add uts namespaces into ns_idr
>> ipc: Add ipc namespaces into ns_idr
>> mnt: Add mount namespaces into ns_idr
>> cgroup: Add cgroup namespaces into ns_idr
>> time: Add time namespaces into ns_idr
>>
>>
>> fs/mount.h | 4
>> fs/namespace.c | 14 +
>> fs/nsfs.c | 78 ++++++++
>> fs/proc/Makefile | 1
>> fs/proc/internal.h | 18 +-
>> fs/proc/namespaces.c | 382 +++++++++++++++++++++++++++-------------
>> fs/proc/root.c | 17 ++
>> fs/proc/task_namespaces.c | 183 +++++++++++++++++++
>> include/linux/cgroup.h | 6 -
>> include/linux/ipc_namespace.h | 3
>> include/linux/ns_common.h | 11 +
>> include/linux/pid_namespace.h | 4
>> include/linux/proc_fs.h | 1
>> include/linux/proc_ns.h | 12 +
>> include/linux/time_namespace.h | 10 +
>> include/linux/user_namespace.h | 10 +
>> include/linux/utsname.h | 10 +
>> include/net/net_namespace.h | 11 -
>> init/version.c | 2
>> ipc/msgutil.c | 2
>> ipc/namespace.c | 17 +-
>> ipc/shm.c | 1
>> kernel/cgroup/cgroup.c | 2
>> kernel/cgroup/namespace.c | 25 ++-
>> kernel/pid.c | 2
>> kernel/pid_namespace.c | 46 +++--
>> kernel/time/namespace.c | 20 +-
>> kernel/user.c | 2
>> kernel/user_namespace.c | 23 ++
>> kernel/utsname.c | 23 ++
>> net/core/net-sysfs.c | 6 -
>> net/core/net_namespace.c | 18 +-
>> net/ipv4/inet_timewait_sock.c | 4
>> net/ipv4/tcp_metrics.c | 2
>> 34 files changed, 746 insertions(+), 224 deletions(-)
>> create mode 100644 fs/proc/task_namespaces.c
>>
>> --
>> Signed-off-by: Kirill Tkhai <[email protected]>

2020-07-30 20:56:59

Christian Brauner <[email protected]> writes:

> On Mon, Aug 17, 2020 at 10:48:01AM -0500, Eric W. Biederman wrote:
>>
>> Creating names in the kernel for namespaces is very difficult and
>> problematic. I have not seen anything that looks like all of the
>> problems have been solved with restoring these new names.
>>
>> When your filter for your list of namespaces is user namespace creating
>> a new directory in proc is highly questionable.
>>
>> As everyone uses proc placing this functionality in proc also amplifies
>> the problem of creating names.
>>
>>
>> Rather than proc having a way to mount a namespace filesystem filter by
>> the user namespace of the mounter likely to have many many fewer
>> problems. Especially as we are limiting/not allow new non-process
>> things and ideally finding a way to remove the non-process things.
>>
>>
>> Kirill you have a good point that taking the case where a pid namespace
>> does not exist in a user namespace is likely quite unrealistic.
>>
>> Kirill mentioned upthread that the list of namespaces are the list that
>> can appear in a container. Except by discipline in creating containers
>> it is not possible to know which namespaces may appear in attached to a
>> process. It is possible to be very creative with setns, and violate any
>> constraint you may have. Which means your filtered list of namespaces
>> may not contain all of the namespaces used by a set of processes. This
>
> Indeed. We use setns() quite creatively when intercepting syscalls and
> when attaching to a container.
>
>> further argues that attaching the list of namespaces to proc does not
>> make sense.
>>
>> Andrei has a good point that placing the names in a hierarchy by
>> user namespace has the potential to create more freedom when
>> assigning names to namespaces, as it means the names for namespaces
>> do not need to be globally unique, and while still allowing the names
>> to stay the same.
>>
>>
>> To recap the possibilities for names for namespaces that I have seen
>> mentioned in this thread are:
>> - Names per mount
>> - Names per user namespace
>>
>> I personally suspect that names per mount are likely to be so flexibly
>> they are confusing, while names per user namespace are likely to be
>> rigid, possibly too rigid to use.
>>
>> It all depends upon how everything is used. I have yet to see a
>> complete story of how these names will be generated and used. So I can
>> not really judge.
>
> So I haven't fully understood either what the motivation for this
> patchset is.
> I can just speak to the use-case I had when I started prototyping
> something similar: We needed a way to get a view on all namespaces
> that exist on the system because we wanted a way to do namespace
> debugging on a live system. This interface could've easily lived in
> debugfs. The main point was that it should contain all namespaces.
> Note, that it wasn't supposed to be a hierarchical format it was only
> mean to list all namespaces and accessible to real root.
> The interface here is way more flexible/complex and I haven't yet
> figured out what exactly it is supposed to be used for.
>
>>
>>
>> Let me add another take on this idea that might give this work a path
>> forward. If I were solving this I would explore giving nsfs directories
>> per user namespace, and a way to mount it that exposed the directory of
>> the mounters current user namespace (something like btrfs snapshots).
>>
>> Hmm. For the user namespace directory I think I would give it a file
>> "ns" that can be opened to get a file handle on the user namespace.
>> Plus a set of subdirectories "cgroup", "ipc", "mnt", "net", "pid",
>> "user", "uts") for each type of namespace. In each directory I think
>> I would just have a 64bit counter and each new entry I would assign the
>> next number from that counter.
>>
>> The restore could either have the ability to rename files or simply the
>> ability to bump the counter (like we do with pids) so the names of the
>> namespaces can be restored.
>>
>> That winds up making a user namespace the namespace of namespaces, so
>> I am not 100% about the idea.
>
> I think you're right that we need to understand better what the use-case
> is. If I understand your suggestion correctly it wouldn't allow to show
> nested user namespaces if the nsfs mount is per-user namespace.

So what I was thinking is that we have the user namespace directories
and that the mount code would perform a bind mount such that the
directory that matches the mounters user namespace is the root
directory.

> Let me throw in a crazy idea: couldn't we just make the ioctl_ns() walk
> a namespace hierarchy? For example, you could pass in a user namespace
> fd and then you'd get back a struct with handles for fds for the
> namespaces owned by that user namespace and then you could use
> NS_GET_USERNS/NS_GET_PARENT to walk upwards from the user namespace fd
> passed in initially and so on? Or something similar/simpler. This would
> also decouple this from procfs somewhat.

Hmm.

That would remove the need to have names. We could just keep a list
of the namespaces in creation order. Hopefully the CRIU folks could
preserve that create order without too much trouble.

Say with an ioctl NS_NEXT_CREATION which takes two fds, and returns
a new file descriptor. The arguments would be the user namespace
and -1 or the file descriptor last returned fro NS_NEXT_CREATION.

Assuming that is not difficult for CRIU to restore that would be a very
simple patch.

Eric