linux-kernel - Re: + core_pattern-set-core-helpers-root-and-namespace-to-crashing-process .patch added to -mm tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <874njj3x9d.fsf@xmission.com>
Date:	Tue, 18 Dec 2012 12:45:18 -0800
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Neil Horman <nhorman@...driver.com>
Cc:	Oleg Nesterov <oleg@...hat.com>,
	Pavel Emelyanov <xemul@...allels.com>,
	Daniel Berrange <berrange@...hat.com>,
	Alexander Viro <viro@...iv.linux.org.uk>,
	Serge Hallyn <serge.hallyn@...onical.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org
Subject: Re: + core_pattern-set-core-helpers-root-and-namespace-to-crashing-process .patch added to -mm tree

Neil Horman <nhorman@...driver.com> writes:

> On Tue, Dec 18, 2012 at 09:06:04PM +0100, Oleg Nesterov wrote:
>> On 12/17, Neil Horman wrote:
>> >
>> > On Mon, Dec 17, 2012 at 05:04:08PM +0100, Oleg Nesterov wrote:
>> > >
>> > > > Is there a way to switch all namespaces, except for the pid
>> > > > namespace?
>> > >
>> > > Which exactly namespaces you want to change?
>> > >
>> > Ideally, I want the pipe reader process to execute in the same namespaces that
>> > the crashing process executed in (i.e. the pipe reader should execute as though
>> > the crashing process forked it).
>> 
>> Yes, and we probably want to change pid_ns as well. But afaics currently
>> this is not possible, even setns can't do this.

The code for setns to change the pid namespace just merged.

Oleg I copied you on that code when I put it up for review.  Did I use
the wrong email address?

>> BTW. Of course this is subjective, but personally I think that "||"
>> looks strange. Perhaps it would be better to add something like
>> --croot argument?
>> 
> The || is ambiguous with its simmilarity to a shell 'or' command, but I don't
> think the --croot argument is much better on that front, as that then becomes
> ambiguous with arguments supplied to the pipe reader directly.  The token should
> be leading the pipe_reader string in core_pattern to indicate a change in
> environment independent of the executable path.  Perhaps |^ or something
> simmilar?

I failed to send my earlier reply but there is another problem with the
approach of only having one global core dump pattern.  You can't set it
per container.  Which means a special character to switch namespeces
while a reasonable solution (and arguably unnecessary solution) is not a
complete solution.

> Either way, Andrew, could you please drop this patch?  Olegs comments I think
> make it pretty clear I've got some more work to do on this.

If we just want one pattern we should be able to to robustly implement
this in userspace with the existing functionality.  With the caveat that
we need to get some pid namespace and user namespace bugs in the core
pattern generation fixed.  But we need to fix those bugs anyway.

Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/