linux-kernel - RE: [PATCH v2] ns: introduce getnspid syscall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 23 Jun 2014 10:15:37 +0000
From:	"chenhanxiao@...fujitsu.com" <chenhanxiao@...fujitsu.com>
To:	Richard Weinberger <richard@....at>,
	"containers@...ts.linux-foundation.org" 
	<containers@...ts.linux-foundation.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Pavel Emelyanov <xemul@...allels.com>
CC:	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Serge Hallyn <serge.hallyn@...ntu.com>,
	"Daniel P. Berrange" <berrange@...hat.com>,
	"Oleg Nesterov" <oleg@...hat.com>,
	Al Viro <viro@...iv.linux.org.uk>,
	David Howells <dhowells@...hat.com>,
	Vasiliy Kulikov <segooon@...il.com>,
	"Gotou, Yasunori" <y-goto@...fujitsu.com>,
	"linux-api@...r.kernel.org" <linux-api@...r.kernel.org>
Subject: RE: [PATCH v2] ns: introduce getnspid syscall

Hi

> -----Original Message-----
> From: Richard Weinberger [mailto:richard@....at]
> Sent: Friday, June 20, 2014 7:02 PM
> To: Chen, Hanxiao/陈 晗霄; containers@...ts.linux-foundation.org;
> linux-kernel@...r.kernel.org
> Cc: Eric W. Biederman; Serge Hallyn; Daniel P. Berrange; Oleg Nesterov; Al Viro;
> David Howells; Pavel Emelyanov; Vasiliy Kulikov; Gotou, Yasunori/五�u 康文;
> linux-api@...r.kernel.org
> Subject: Re: [PATCH v2] ns: introduce getnspid syscall
> 
> Am 20.06.2014 12:18, schrieb Chen Hanxiao:
> > We need a direct method of getting the pid inside containers.
> > If some issues occurred inside container guest, host user
> > could not know which process is in trouble just by guest pid:
> > the users of container guest only knew the pid inside containers.
> > This will bring obstacle for trouble shooting.
> >
> > int getnspid(pid_t pid, int fd1, int fd2);
> >
> > pid: the pid number need to be translated.
> >
> > fd: a file descriptor referring to one of
> >     the namespace entries in a /proc/[pid]/ns/pid.
> >     fd1 for destination ns(ns1), where the pid came from.
> >     fd2 for reference ns(ns2), while fd2 = -2 means for current ns.
> >
> > return value:
> >     >0 : translated pid in ns1(fd1) seen from ns2(fd2).
> >     <=0: on failure.
> >
> 
> I don't think that adding a new system call for this is a good solution.
> We need a more generic way. I bet people are interested in more than just PID
> numbers.

Could you please give some hints on how to expand this interface?

> 
> I agree with Eric that a procfs solution is more appropriate.
> 

Procfs is a good solution, but syscall is not bad though.
Procfs works for me, but that seems could not fit
Pavel's requirement.
His opinion is that a syscall is a more generic interface
than proc files, and  also very helpful.
And syscall could tell whether a pid lives in a specific pid namespace,
much convenient than procfs.

Thanks,
- Chen