Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH v4] pidns: introduce syscall translate_pid
To:     Andrew Morton <akpm@linux-foundation.org>,
        Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Cc:     Oleg Nesterov <oleg@redhat.com>, linux-api@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        Serge Hallyn <serge.hallyn@ubuntu.com>,
        "Eric W. Biederman" <ebiederm@xmission.com>,
        Eugene Syromiatnikov <esyr@redhat.com>,
        prakash sangappa <prakash.sangappa@oracle.com>
References: <150788678482.924140.11785205105514746135.stgit@buzz>
 <20171013160514.GA27812@redhat.com>
 <3bdb5341-9ae6-265a-ce5b-45c2cfc76fad@yandex-team.ru>
 <d7b2a0b6-6d0c-5ca8-9d2b-3a1211713d34@yandex-team.ru>
 <20171016143628.b2ef80a9ef16d4345889b4d9@linux-foundation.org>
From:   Nagarathnam Muthusamy <nagarathnam.muthusamy@oracle.com>
Message-ID: <fc2ae985-7ef7-0caf-4eb9-9348a5ca5e78@oracle.com>
Date:   Mon, 16 Oct 2017 15:07:52 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.3.0
MIME-Version: 1.0
In-Reply-To: <20171016143628.b2ef80a9ef16d4345889b4d9@linux-foundation.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


On 10/16/2017 02:36 PM, Andrew Morton wrote:
> On Sat, 14 Oct 2017 11:17:47 +0300 Konstantin Khlebnikov <khlebnikov@yandex-team.ru> wrote:
>
>>>>> pid_t translate_pid(pid_t pid, int source, int target);
>>>>>
>>>>> This syscall converts pid from source pid-ns into pid in target pid-ns.
>>>>> If pid is unreachable from target pid-ns it returns zero.
>>>>>
>>>>> Pid-namespaces are referred file descriptors opened to proc files
>>>>> /proc/[pid]/ns/pid or /proc/[pid]/ns/pid_for_children. Negative argument
>>>>> refers to current pid namespace, same as file /proc/self/ns/pid.
>>>>>
>>>>> Kernel expose virtual pids in /proc/[pid]/status:NSpid, but backward
>>>>> translation requires scanning all tasks. Also pids could be translated
>>>>> by sending them through unix socket between namespaces, this method is
>>>>> slow and insecure because other side is exposed inside pid namespace.
>> Andrew asked why we might need this.
>>
>> Such conversion is required for interaction between processes across pid-namespaces.
>> For example to identify process in container by pid file looking from outside.
>>
>> Two years ago I've solved this in project of mine with monstrous code which
>> forks couple times just to convert pid, lucky for me performance wasn't important.
> That's a single user who needed this a single time, and found a
> userspace-based solution anyway.  This is not exactly compelling!
>
> Is there a stronger case to be made?  How does this change benefit our
> users?  Sell it to us!
Oracle database is planning to use pid namespace for sandboxing database 
instances and they need an API similar to translate_pid to effectively 
translate process IDs from other pid namespaces. Prakash (cced in mail) 
can provide more details on this usecase.

Thanks,
Nagarathnam.


From 1581463896850208177@xxx Tue Oct 17 00:51:40 +0000 2017
X-GM-THRID: 1581133950441644275
X-Gmail-Labels: Inbox,Category Forums