linux-kernel - Re: [PATCH] sysctl: Add the kernel.ns_last

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 29 Nov 2011 20:22:45 +0100
From:	Oleg Nesterov <oleg@...hat.com>
To:	Pavel Emelyanov <xemul@...allels.com>
Cc:	Tejun Heo <tj@...nel.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Cyrill Gorcunov <gorcunov@...nvz.org>
Subject: Re: [PATCH] sysctl: Add the kernel.ns_last_pid control

On 11/29, Pavel Emelyanov wrote:
>
> On 11/29/2011 09:47 PM, Oleg Nesterov wrote:
> >> +
> >> +static struct ctl_path kern_path[] = { { .procname = "kernel", }, { } };
> >> +
> >>  static __init int pid_namespaces_init(void)
> >>  {
> >>  	pid_ns_cachep = KMEM_CACHE(pid_namespace, SLAB_PANIC);
> >> +	register_sysctl_paths(kern_path, pid_ns_ctl_table);
> >>  	return 0;
> >>  }
> >
> > Hmm. This way it depends on CONFIG_PID_NS.
>
> Yes, since this _is_ for namespaces. As we've found out this is close to completely
> unusable in the initial namespace in which tasks are just forking without caring
> much about what CAP_SYS_ADMIN-s think about this.

I agree, it is not very much usable. Still I think it can be used.
Say, init can write RESERVED_PIDS to this file. Or you can use it
to test the pid-reuse problems.

> > Can't we simply add an entry into kern_table[] ?
>
> And store the .proc_handler function dealing with somewhat which is pid namespace
> specific in the same generic file?

Why not? In fact I think that, say, /proc/sys/kernel/pid_max should
act per-namespace too.

> > And without ns_, just /proc/sys/kernel/last_pid.
>
> But that's the namespace's last pid, not just some system-wide last pid.

Sure, it is not system wide. Unless you use it from the root ns.


OK. I do not really care. I think the patch is correct, lets do it
this way.

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/