linux-kernel - Re: [ABI REVIEW][PATCH 0/8] Namespace file descriptors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <m11v8kh142.fsf@fess.ebiederm.org>
Date:	Thu, 23 Sep 2010 09:32:29 -0700
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	David Lamparter <equinox@...c24.net>
Cc:	linux-kernel@...r.kernel.org,
	Linux Containers <containers@...ts.osdl.org>,
	netdev@...r.kernel.org, netfilter-devel@...r.kernel.org,
	linux-fsdevel@...r.kernel.org, jamal <hadi@...erus.ca>,
	Daniel Lezcano <daniel.lezcano@...e.fr>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Michael Kerrisk <mtk.manpages@...il.com>,
	Ulrich Drepper <drepper@...il.com>,
	Al Viro <viro@...IV.linux.org.uk>,
	David Miller <davem@...emloft.net>,
	"Serge E. Hallyn" <serge@...lyn.com>,
	Pavel Emelyanov <xemul@...nvz.org>,
	Pavel Emelyanov <xemul@...allels.com>,
	Ben Greear <greearb@...delatech.com>,
	Matt Helsley <matthltc@...ibm.com>,
	Jonathan Corbet <corbet@....net>,
	Sukadev Bhattiprolu <sukadev@...ux.vnet.ibm.com>,
	Jan Engelhardt <jengelh@...ozas.de>,
	Patrick McHardy <kaber@...sh.net>
Subject: Re: [ABI REVIEW][PATCH 0/8] Namespace file descriptors

David Lamparter <equinox@...c24.net> writes:

> On Thu, Sep 23, 2010 at 01:45:04AM -0700, Eric W. Biederman wrote:
>> Introduce file for manipulating namespaces and related syscalls.
>> files:
>> /proc/self/ns/<nstype>
>
> As feedback from using network namespaces extensively in more or less
> production setups, I would like to make a request/suggestion: there
> needs to be a way to enumerate network namespaces independent from
> by-pid access.
>
> At several occasions, I was left with either some runaway daemon which
> kept the namespace alive. To describe this a little more graphically:
> I found no other way than doing a
> 	md5sum /proc/*/net/if_inet6 | sort | uniq -c -w 32
> to find out which runaway to kill to terminate the namespace.
>
> This makes network namespaces particularly cumbersome to use without PID
> namespaces. While I agree that a large part of the users - namely lxc -
> will use them together, network namespaces without pidns are very
> interesting for routing applications implementing VRFs.
>
> Is it possible to add some kind of "all namespaces" list, optimally
> giving an opportunity to open() exactly this file descriptor that you
> get from /proc/<pid>/ns/net?
>
> Also, is it possible to extend that file descriptor to have an
> "get all pids" ioctl,
> ...or, wait, maybe have /proc/...ns/proc/<pid> symlink?
>
> (This obviously isn't fully thought to the end, please pick up...)

Maybe.  I can understand the pain.

Is the problem you are facing you are shutting down a vrf and you want
to make certain nothing is using it any longer?

Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/