linux-kernel - Re: [RFC] [PATCH -mm] cgroup: uid-based rules to add processes efficiently in the right cgroup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a2776ec50808190735y4a122e41tca61e1bce3727760@mail.gmail.com>
Date:	Tue, 19 Aug 2008 16:35:36 +0200
From:	righi.andrea@...il.com
To:	"Vivek Goyal" <vgoyal@...hat.com>
Cc:	"KAMEZAWA Hiroyuki" <kamezawa.hiroyu@...fujitsu.com>,
	"Paul Menage" <menage@...gle.com>,
	"Balbir Singh" <balbir@...ux.vnet.ibm.com>,
	"linux kernel mailing list" <linux-kernel@...r.kernel.org>,
	"Dhaval Giani" <dhaval@...ux.vnet.ibm.com>,
	"Kazunaga Ikeno" <k-ikeno@...jp.nec.com>,
	"Morton Andrew Morton" <akpm@...ux-foundation.org>,
	"Thomas Graf" <tgraf@...hat.com>,
	"Ulrich Drepper" <drepper@...hat.com>,
	"Steve Olivieri" <solivier@...hat.com>,
	"Rik Van Riel" <riel@...hat.com>
Subject: Re: [RFC] [PATCH -mm] cgroup: uid-based rules to add processes efficiently in the right cgroup

On Mon, Aug 18, 2008 at 08:35:26AM -0400, Vivek Goyal wrote:
> On Sun, Aug 17, 2008 at 12:33:31PM +0200, Andrea Righi wrote:
> > The problem of placing tasks in respective cgroups seems to be correctly
> > addressed by userspace lib wrappers or classifier daemons [1].
> >
> > However, this is an attempt to implement an in-kernel classifier.
> >
> > [ I wrote this patch for a "special purpose" environment, where a lot of
> > short-lived processes belonging to different users are spawned by
> > different daemons, so the main goal here would be to remove the dealy
> > needed by userspace classification and place the tasks in the right
> > cgroup at the time they're created. This is just an ugly hack for now
> > and it works only for uid-based rules, gid-based rules could be
> > implemented in a similar way. ]
> >
>
> Hi  Andrea,

yep! I'm having some troubles with my internet connection, and it seems
my previous reply is lost.. :( resending it, sorry for the noise if
you'll receive more than 1 mail.

>
> Recently I introduced the infrastructure in libcgroup to handle
> the task placement issue based on uid and gid rules. This is what I did.
>
> - Introduced two new APIs in libcgroup to place the task in right cgroup.
> 	- cgroup_change_cgroup_uid_gid
> 		Pleces the task in destination cgroup based on uid/gid
> 		rules specified in /etc/cgrules.conf
> 	- cgroup_change_cgroup_path
> 		Puts the task into the cgroup specified by caller
>
> - Provided two command line tools (cgexec and cgclassify) to perform
>   various process placement related tasks.
> 	- cgexec
> 		A tool to launch a task in user specfied cgroup
> 	- cgclassify
> 		A tool to re-classify already running tasks.
>
> - Wrote a pam plugin so that tasks are placed in right user groups upon
>   login or reception of other services which take pam's help.

That's interesting. All the daemons that provide access to a system
should pam-aware, so with the pam plugin I should be able to handle all
the cases. Unfortunately I don't have too much details about those
daemons and in fact I was looking for the most generic solution..

>
> - Currently work is in progress for a user space daemon which will
>   automatically place the tasks based on notifications.
>
> For your environment, where delay is unbearable, I think you can modify
> the daemon to use libcgroup to place the forked task in right cgroup
> before actually executing it. Once the task has been placed in right
> cgroup, exec() will be called.
>

The deamons should all use the exec() + setuid() way. If pam doesn't
help I'll try to wrap setuid(), using a wrapper lib or something
similar.

> We have been doing all the user space development on following mailing
> list.
>
> https://lists.sourceforge.net/lists/listinfo/libcg-devel
>
> Latest patches which got merged in libcgroup, are here.
>
> http://sourceforge.net/mailarchive/forum.php?thread_name=20080813171720.108005557%40redhat.com&forum_name=libcg-devel
>
> It is accompanied with a decent README file for design details and for
> how to use it.

Thanks, I'll look at the latest libcgroup features ASAP.

>
> I think modifying the daemon to make use of libcgroup is the right way
> to handle this issue than duplicating the infrastructure in user space
> as well as kernel space.

Totally agree in perspective (obviously when it's possible/reasonable in
terms of efforts to change the userspace daemon).

Thanks,
-Andrea
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/