linux-kernel - Re: [ckrm-tech] [PATCH 3/9] Containers (V9): Add tasks file interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 1 May 2007 13:37:24 -0700
From:	"Paul Menage" <menage@...gle.com>
To:	balbir@...ux.vnet.ibm.com
Cc:	vatsa@...ibm.com, ckrm-tech@...ts.sourceforge.net,
	balbir@...ibm.com, haveblue@...ibm.com, xemul@...ru, dev@...ru,
	containers@...ts.osdl.org, pj@....com, devel@...nvz.org,
	ebiederm@...ssion.com, mbligh@...gle.com, rohitseth@...gle.com,
	serue@...ibm.com, akpm@...ux-foundation.org,
	svaidy@...ux.vnet.ibm.com, linux-kernel@...r.kernel.org
Subject: Re: [ckrm-tech] [PATCH 3/9] Containers (V9): Add tasks file interface

On 5/1/07, Balbir Singh <balbir@...ux.vnet.ibm.com> wrote:
> > +     if (container_is_removed(cont)) {
> > +             retval = -ENODEV;
> > +             goto out2;
> > +     }
>
> Can't we make this check prior to kmalloc() and copy_from_user()?

We could but I'm not sure what it would buy us - we'd be optimizing
for the case that essentially never occurs.

>
>
>
> > +int container_task_count(const struct container *cont) {
> > +     int count = 0;
> > +     struct task_struct *g, *p;
> > +     struct container_subsys_state *css;
> > +     int subsys_id;
> > +     get_first_subsys(cont, &css, &subsys_id);
> > +
> > +     read_lock(&tasklist_lock);
>
> Can be replaced with rcu_read_lock() and rcu_read_unlock()

Are you sure about that? I see many users of
do_each_thread()/while_each_thread() taking a lock on tasklist_lock,
and only one (fs/binfmt_elf.c) that's clearly relying on an RCU
critical sections. Documentation?

>
> Any chance we could get a per-container task list? It will
> help subsystem writers as well.

It would be possible, yes - but we probably wouldn't want the overhead
(additional ref counts and list manipulations on every fork/exit) of
it on by default. We could make it a config option that particular
subsystems could select.

I guess the question is how useful is this really, compared to just
doing a do_each_thread() and seeing which tasks are in the container?
Certainly that's a non-trivial operation, but in what circumstances is
it really necessary to do it?

Paul
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/