linux-kernel - Re: [PATCHv3 2/2] /proc/PID/status: show all sets of pid according to ns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20140930160755.GB6838@mail.hallyn.com>
Date:	Tue, 30 Sep 2014 18:07:55 +0200
From:	"Serge E. Hallyn" <serge@...lyn.com>
To:	"Serge E. Hallyn" <serge@...lyn.com>
Cc:	"Chen, Hanxiao" <chenhanxiao@...fujitsu.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	"containers@...ts.linux-foundation.org" 
	<containers@...ts.linux-foundation.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Oleg Nesterov <oleg@...hat.com>,
	Richard Weinberger <richard.weinberger@...il.com>,
	Serge Hallyn <serge.hallyn@...ntu.com>,
	Mateusz Guzik <mguzik@...hat.com>,
	David Howells <dhowells@...hat.com>,
	"Pavel Emelyanov (xemul@...allels.com)" <xemul@...allels.com>
Subject: Re: [PATCHv3 2/2] /proc/PID/status: show all sets of pid according
 to ns

Quoting Serge E. Hallyn (serge@...lyn.com):
> Quoting Chen, Hanxiao (chenhanxiao@...fujitsu.com):
> > Hi,
> > 
> > > -----Original Message-----
> > > From: Serge E. Hallyn [mailto:serge@...lyn.com]
> > > Sent: Monday, September 29, 2014 10:00 PM
> > > Subject: Re: [PATCHv3 2/2] /proc/PID/status: show all sets of pid according to
> > > ns
> > [snip]
> > > > >
> > > > > This patch adds four fields: NStgid, NSpid, NSpgid and NSsid:
> > > > > a) In init_pid_ns, nothing changed;
> > > > >
> > > > > b) In one pidns, will tell the pid inside containers:
> > > > > NStgid:	21776   5       1
> > > > > NSpid:  21776   5       1
> > > > > NSpgid:	21776   5       1
> > > > > NSsid:  21729   1       0
> > > > > ** Process id is 21776 in level 0, 5 in level 1, 1 in level 2.
> > > > >
> > > > > c) If pidns is nested, it depends on which pidns are you in.
> > > > > NStgid: 5       1
> > > > > NSpid:  5       1
> > > > > NSpgid: 5       1
> > > > > NSsid:  1       0
> > > > > ** Views from level 1
> > > > >
> > > >
> > > > This patch is simple, useful and safe.
> > > > But currently there is not any feedbacks.
> > > >
> > > > Any comments or ideas?
> > > 
> > > Thanks, Chen.  The code looks fine.  My concern is that you are
> > > exposing information which cannot be checkpointed and restarted.
> > > In particular, if I'm inside a nested container, so I'm in pidns
> > > level 3, then my own NSpid info, when I read it, will show the
> > > pids at parent namespaces.  If I'm restarted at the third pidns
> > > level, only the one pid can be restored.
> > 
> > If you're in level 3, read your own proc, only level 3's NSpid info
> > will be shown. No parent namesapces info could be seen.
> 
> D'oh!  Sorry, I see, you're starting at ns->level.  And ns is the ns
> of the proc mount, not the caller.  that looks good.
> 
> So
> 
> Acked-by: Serge Hallyn <serge.hallyn@...onical.com>

Also

Tested-by: Serge Hallyn <serge.hallyn@...onical.com>

as I've tested this between a few containers.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/