Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752138AbbBKAkm (ORCPT ); Tue, 10 Feb 2015 19:40:42 -0500 Received: from mx1.redhat.com ([209.132.183.28]:35446 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751983AbbBKAkk (ORCPT ); Tue, 10 Feb 2015 19:40:40 -0500 Message-ID: <1423615225.2599.25.camel@pluto.fritz.box> Subject: Re: [RFC PATCH 3/8] kmod - teach call_usermodehelper() to use a namespace From: Ian Kent To: Oleg Nesterov Cc: Kernel Mailing List , David Howells , Trond Myklebust , "J. Bruce Fields" , Benjamin Coddington , Al Viro , Jeff Layton , "Eric W. Biederman" Date: Wed, 11 Feb 2015 08:40:25 +0800 In-Reply-To: <20150210165503.GA6797@redhat.com> References: <20150205021553.8382.16297.stgit@pluto.fritz.box> <20150205023410.8382.13695.stgit@pluto.fritz.box> <20150208190019.GA22948@redhat.com> <1423446203.2583.18.camel@pluto.fritz.box> <20150209160328.GA2817@redhat.com> <1423526889.2612.14.camel@pluto.fritz.box> <20150210165503.GA6797@redhat.com> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2535 Lines: 80 On Tue, 2015-02-10 at 17:55 +0100, Oleg Nesterov wrote: > On 02/10, Ian Kent wrote: > > > > On Mon, 2015-02-09 at 17:03 +0100, Oleg Nesterov wrote: > > > > > > I understand. but I still can't understand why we can't implement something > > > like > > > enter_ns(struct nsproxy *p) > > > { > > > new_nsproxy = create_new_namespaces(...); > > > > > > p->mnt_ns->ns->ops->install(new_nsproxy, ...); > > > p->pid_ns_for_children->ns->ops->install(new_nsproxy, ...); > > > ... > > > > > > switch_task_namespaces(new_nsproxy); > > > } > > > > > > Why we should abuse fs/proc ? > > > > That sounds like a much better approach. > > Your saying just take a reference to the nsproxy from the located > > process and use it instead, right? > > Yes, > > > Working out if there's a difference with what you from the open is > > challenging (I already tried), I'll have another go at it. > > I thinks there should not be any difference, but please re-check ;) > > > > And. Whatever we do, ops->install() or setns_inode() can't solve the problem with > > > pid_ns. You need the additional clone() to "activate" it. pidns_install() does not > > > actually change task_active_pid_ns(). > > > > Right, but all this is done in preparation for the following do_execve() > > call. Isn't that enough or am I missing something? > > Yes, but do_execve() doesn't (and shouldn't) change task_active_pid_ns(). Note > the ->pid_ns_for_children's name. It is only used by copy_process()->alloc_pid(). Right, I vaguely recall seeing something like this earlier in the fork procedure, I get it. I'll need to have a another look at it. > > task_active_pid_ns() uses task_pid() and we obviously can't change it. > > I am wondering if we can do something like > > kernel_thread_in_ns(struct nsproxy *ns, ...) > { > struct nsproxy *saved_ns = current->nsproxy; > pid_t pid; > > task_lock(current); > current->nsproxy = ns; > task_unlock(current); > > pid = kernel_thread(...); > > task_lock(current); > current->nsproxy = saved_ns; > task_unlock(current); > > return pid; > } > > used by __call_usermodehelper/wait_for_helper, instead of "enter_ns" from > sub_info->init()... Again, thanks for the suggestions. You've given me a few things think about and check out. Ian -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/