linux-kernel - Re: [RFC]Pid conversion between pid namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140728132455.GB464@ubuntumail>
Date:	Mon, 28 Jul 2014 13:24:56 +0000
From:	Serge Hallyn <serge.hallyn@...ntu.com>
To:	Hu Tao <hutao@...fujitsu.com>
Cc:	"chenhanxiao@...fujitsu.com" <chenhanxiao@...fujitsu.com>,
	"Richard Weinberger (richard@....at)" <richard@....at>,
	"containers@...ts.linux-foundation.org" 
	<containers@...ts.linux-foundation.org>,
	"Oleg Nesterov (oleg@...hat.com)" <oleg@...hat.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"Eric W. Biederman (ebiederm@...ssion.com)" <ebiederm@...ssion.com>,
	"Vasily Kulikov (segoon@...nwall.com)" <segoon@...nwall.com>
Subject: Re: [RFC]Pid conversion between pid namespace

Quoting Hu Tao (hutao@...fujitsu.com):
> Hi,
> 
> On Fri, Jul 25, 2014 at 05:34:43PM +0000, Serge Hallyn wrote:
> > Quoting chenhanxiao@...fujitsu.com (chenhanxiao@...fujitsu.com):
> > > Hi,
> > > 
> > > > -----Original Message-----
> > > > From: Serge Hallyn [mailto:serge.hallyn@...ntu.com]
> > > > Sent: Tuesday, July 15, 2014 12:16 PM
> > > > To: Chen, Hanxiao/陈 晗霄
> > > > Subject: Re: [RFC]Pid conversion between pid namespace
> > > > >     A-2) syscall pid_t getnspid(pid_t query_pid, pid_t observer_pid)
> > > > >     pros:
> > > > >         - ns procfs free, easy to use.
> > > > >         We could get rid of mounted ns procfs.
> > > > >
> > > > >     cons:
> > > > >         - may find multiple results in nested ns.
> > > > >           We wished the new API could tell us the exact answer.
> > > > >           But if getnspid return more than one results will bring trouble to admins,
> > > > 
> > > > (See below for more, but) the question being posed to getnspid has precisely
> > > > one answer.
> > > > 
> > > > >           they had to make another decision.
> > > > >           Or we marked the deepest level for translation as prerequisite.
> > > > >
> > > > >         -based on current pidns, no reference ns.
> > > > 
> > > > Hm, no.  The intent here was that
> > > > 
> > > > 	observer_pid would be in current ns
> > > > 	query_pid would be in observer_pid's ns.
> > > > 
> > > > So this would be ideal for "I got a pid in a logfile created by rsyslog in
> > > > a nested contaner, what is the logged pid in my pidns."
> > > > 
> > > > Taking a set of tasks (like a container with nesting) and bulding a tree
> > > > of all pids shouldn't be too difficult either.  Start with the init pid,
> > > > call getnspid($pid, $init_pid) for every $pid in the container;  to figure
> > > > out whether any $pid is itself a nested init_pid, we can compare the
> > > > /proc/$$/ns/pid, as well as look at getnspid($pid, $pid).
> > > I'm a little confused in this section:
> > > 
> > > Ex:
> > >     init_pid_ns    ns1         ns2
> > > t1  2
> > > t2   `- 3          1 
> > > t3       `- 4      `- 5        1
> > > t4           `-6       `-8      `-9
> > > t5             `-10       `-9      `-10
> > > 
> > > For getnspid($pid, $init_pid),
> > > Does init_pid means container's init_pid such as 3 for t2?
> > 
> > Right, if you're in init_pid_ns and making the query, then
> > you'd pass 3.
> 
> Sorry for jumping in, but I'm not quite understanding the purpose of
> $init_pid here, does it identify the ns which the process to be
> queried is in? Also see my questions below:

I was passing in initpid for a particular reason before, the second
argument is NOT meant to be an "initpid", it's meant to be the pid
(in caller's ns) of the observer pid - the pid in whose namespace we
are querying.

> 1. Given the example above, what's the return of getnspid(9, 3)? 
>    Is it 6(task t4) or 10(task t5)? 

Assuming the caller is in init_pid_ns, then the return value is t5.

> 
> 2. if there is a process in ns1 which is a child of process 1 has pid
>    10, but not in ns2, like below:
> 
>     init_pid_ns          ns1         ns2
> t1  2
> t2   `- 3                1 
> t3       `- 4            +- 5        1
> t4           `-6         |   `-8      `-9
> t5             `-10      |      `-9      `-10
> t6               `-11    `-10   
> 
>    then what is the return of getnspid(10, 3)?

Assuming the caller is in init_pid_ns, the answer is t6.  The question
was "In the pid_ns belonging to t2 (pid 3), what task does the pid
10 refer to".
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/