linux-kernel - RE: [RFC PATCH 2/3] procfs: show hierarchy of pid namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 4 Sep 2014 10:13:45 +0000
From:	"Chen, Hanxiao" <chenhanxiao@...fujitsu.com>
To:	Vasiliy Kulikov <segooon@...il.com>
CC:	"containers@...ts.linux-foundation.org" 
	<containers@...ts.linux-foundation.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Serge Hallyn <serge.hallyn@...ntu.com>,
	Oleg Nesterov <oleg@...hat.com>,
	"Al Viro" <viro@...iv.linux.org.uk>,
	David Howells <dhowells@...hat.com>,
	Richard Weinberger <richard.weinberger@...il.com>,
	Pavel Emelyanov <xemul@...allels.com>
Subject: RE: [RFC PATCH 2/3] procfs: show hierarchy of pid namespace

Hi,

> -----Original Message-----
> Hi,
> 
> On Wed, Sep 03, 2014 at 18:29 +0800, Chen Hanxiao wrote:
> > This patch will show the hierarchy of pid namespace
> > under /proc/pidns like:
> > /proc/pidns
> > ├── hierarchy
> > │   ├── pidns4026532399
> > │   │   ├── pidns -> /proc/2863/ns/pid
> > │   │   └── pidns4026532515
> > │   │       └── pidns -> /proc/10611/ns/pid
> > │   └── pidns4026532504
> > │       └── pidns -> /proc/4450/ns/pid
> > └── refresh
> 
> Re: this hierarchy:
> 
> 1) I think it is a bit weird that there is a global hierarchy of NSs with
> symlinks to actual NSs located in some random /proc/PID/ns/pid

It will be a symlink to the init process (PID 1) of that ns.
So it could stand for that namespace.

> directories.  It would be better to have a global tree with actual
> directories and process directories would have symlinks to some subdirs
> in this global tree.

Do you mean create symlinks from every /proc/PID/ns/pid to a global tree?
If that, 
a) we need to rebuild this global tree when pid ns changed.
	It would be a burden even if we don't need to know the hierarchy info. 
b) we need to prepare different tree views for different pid ns level.

> 
> 2) The naming can be changed for even more trivial NSs traversal.
> If the hierarchy is as following --
> 
>     hierarchy/
>       pidns1234/
>         pidns
>         children/
>           pidns3456/
>             ...
>           pidns5678/
>             ...
> 
> -- then it is more simple to traverse the tree as child NSs are all
> files in pidnsXXX/children/, not all files of the mask pidns[0-9]+.

Yeh, naming pidns($init_pid_in_ns) is good idea.
IIUC, my current proposal is the same as your opinion,
but free from children dir.

Tree view like your style:
init_pid_ns
       |
--- ns10--
|         |
ns20    ns21
          |
         ns30

And this patch suggested:
hierarchy/
└── nspid4026532393
    ├── nspid -> /proc/4652/ns/pid		--ns10
    ├── nspid4026532489
    │   └── nspid -> /proc/4701/ns/pid	--ns20
    └── nspid4026532496	
        ├── nspid -> /proc/4706/ns/pid	--ns21
        └── nspid4026532499
            └── nspid -> /proc/4714/ns/pid	--ns30


Thanks,
- Chen

> 
> > a) hierarchy dir:
> >   use to show hierarchy infomation using dir and symlinks.
> >   dirs are named as pidns($inum)
> >   a symlink is created under pidns($inum), and linked to
> >   that pid namespace.
> >
> > b) refresh
> >   trigger key.
> >   We need to write sth to /proc/nspid/refresh,
> >   then we could get hierarchy info
> >   under /proc/pidns/hierarchy.
> >
> 
> --
> Vasily