Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755370AbcDMTB4 (ORCPT ); Wed, 13 Apr 2016 15:01:56 -0400 Received: from h2.hallyn.com ([78.46.35.8]:47410 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754170AbcDMTBz (ORCPT ); Wed, 13 Apr 2016 15:01:55 -0400 Date: Wed, 13 Apr 2016 14:01:52 -0500 From: "Serge E. Hallyn" To: Tejun Heo Cc: "Serge E. Hallyn" , linux-api@vger.kernel.org, adityakali@google.com, Linux Containers , "Eric W. Biederman" , cgroups@vger.kernel.org, lkml Subject: Re: [RFC PATCH] cgroup namespaces: add a 'nsroot=' mountinfo field Message-ID: <20160413190152.GA29753@mail.hallyn.com> References: <20160321234133.GA22463@mail.hallyn.com> <20160413175736.GC3676@htj.duckdns.org> <20160413184639.GA29483@mail.hallyn.com> <20160413185033.GH3676@htj.duckdns.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20160413185033.GH3676@htj.duckdns.org> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1138 Lines: 23 Quoting Tejun Heo (tj@kernel.org): > Hello, Serge. > > On Wed, Apr 13, 2016 at 01:46:39PM -0500, Serge E. Hallyn wrote: > > It's not a leak of any information we're trying to hide. I realize > > something like 8 years have passed, but I still basically go by the > > ksummit guidance that containers are ok but the kernel's first priority > > is to facilitate containers but not trick containers into thinking > > they're not containerized. So long as the container is properly set > > up, I don't think there's anything the workload could do with the > > nsroot= info other than *know* that it is in a ns cgroup. > > > > If we did change that guidance, there's a slew of proc info that we > > could better virtualize :) > > I see. I'm just wondering because the information here seems a bit > gratuituous. Isn't the only thing necessary telling whether the root > is bind mounted or namescoped? Wouldn't simple "nsroot" work for that > purpose? I don't think so - we could be in a cgroup namespace but still have access only to bind-mounted cgroups. So we need to compare the superblock dentry root field to the nsroot= value.