linux-kernel - RE: [RESEND][PATCH 0/2v5] ns, procfs: pid conversion between ns and showing pidns hierarchy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5871495633F38949900D2BF2DC04883E606120@G08CNEXMBPEKD02.g08.fujitsu.local>
Date:	Tue, 28 Oct 2014 09:10:00 +0000
From:	"Chen, Hanxiao" <chenhanxiao@...fujitsu.com>
To:	"containers@...ts.linux-foundation.org" 
	<containers@...ts.linux-foundation.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC:	Richard Weinberger <richard.weinberger@...il.com>,
	Serge Hallyn <serge.hallyn@...ntu.com>,
	Oleg Nesterov <oleg@...hat.com>,
	Mateusz Guzik <mguzik@...hat.com>,
	David Howells <dhowells@...hat.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>
Subject: RE: [RESEND][PATCH 0/2v5] ns,	procfs: pid conversion between ns and
 showing pidns hierarchy



> -----Original Message-----
> From: containers-bounces@...ts.linux-foundation.org
> [mailto:containers-bounces@...ts.linux-foundation.org] On Behalf Of Chen
> Hanxiao
> Sent: Friday, October 24, 2014 6:16 PM
> To: containers@...ts.linux-foundation.org; linux-kernel@...r.kernel.org
> Cc: Richard Weinberger; Serge Hallyn; Oleg Nesterov; Mateusz Guzik; David Howells;
> Eric W. Biederman
> Subject: [RESEND][PATCH 0/2v5] ns, procfs: pid conversion between ns and showing
> pidns hierarchy
> 
> This series will expose pid inside containers
> via procfs.
> Also show the hierarchy of pid namespcae.
> Then we could know how pid looks inside a container
> and their ns relationships.
> 
> 1. helpful for nested container check/restore
> From /proc/PID/ns/pid, we could know whether two pid lived
> in the same ns.
> From this patch, we could know whether two pid had relationship
> between each other.
> 
> 2. used for pid translation from container
> Ex:
>      init_pid_ns    ns1         ns2
>  t1  2
>  t2   `- 3          1
>  t3   `- 4          3
>  t4       `- 5      `- 5        1
>  t5       `- 6      `- 8        3
> 
> It could solve problems like: we see a pid 3 goes wrong
> in container's log, what is its pid on hosts:
> a) inside container:
> # readlink /proc/3/ns/pid
> pid:[4026532388]
> 
> b) on host:
> # cat /proc/pidns_hierarchy
> 14918 16263
> 16581
> Then we could easily find /proc/16263/ns/pid->4026532388.
> On host, we knew that reported pid 3 is in level 2,
>    and its parental pid ns is from pid 14918.
> 
> c) on host, check child of 16263, grep it from status:
> NSpid:  16268   8       3
> 
> We knew that pid 16268 is pid 3 reported by container.
> 

Hi,

Any comments?

Thanks,
- Chen