linux-kernel - RE: [PATCHv5] procfs: show hierarchy of pid namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5871495633F38949900D2BF2DC04883E619A56@G08CNEXMBPEKD02.g08.fujitsu.local>
Date:	Tue, 4 Nov 2014 08:31:27 +0000
From:	"Chen, Hanxiao" <chenhanxiao@...fujitsu.com>
To:	"serge@...lyn.com" <serge@...lyn.com>,
	"containers@...ts.linux-foundation.org" 
	<containers@...ts.linux-foundation.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC:	Richard Weinberger <richard.weinberger@...il.com>,
	Serge Hallyn <serge.hallyn@...ntu.com>,
	Oleg Nesterov <oleg@...hat.com>,
	Mateusz Guzik <mguzik@...hat.com>,
	David Howells <dhowells@...hat.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>
Subject: RE: [PATCHv5] procfs: show hierarchy of pid namespace



> -----Original Message-----
> From: serge@...lyn.com [mailto:serge@...lyn.com]
> Sent: Saturday, November 01, 2014 2:31 AM
> To: containers@...ts.linux-foundation.org; linux-kernel@...r.kernel.org; Chen,
> Hanxiao/陈 晗霄
> Cc: Richard Weinberger; Serge Hallyn; Oleg Nesterov; Mateusz Guzik; David Howells;
> Eric W. Biederman
> Subject: Re: [PATCHv5] procfs: show hierarchy of pid namespace
> 
> If pidns_list_add fails, the get_pid taken in the caller leaks.
> 
Will fix in the next patch.

> It's not clear to me that the loop in 'if curns' will always end in a list_add_tail,
> and if not the get_pid leaks.  It does look like it should, but something to catch
> the unexpected failure (especially after someone modifies that code) would be
> nice

The previous version collect all namespace's pids on host,
in one scenario we had to add them into list according to curr_ns;
another scenario we add them into list directly.
But now using find_ge_pid, we only collect pids of current ns,
so these codes are redundant.
Sorry for that mistake.

Thanks,
- Chen

> On 10/16/14 7:01 Chen Hanxiao wrote:
> We lack of pid hierarchy information, and this will lead to:
> a) we don't know pids' relationship, who is whose child:
>    /proc/PID/ns/pid only tell us whether two pids live in same ns;
> b) bring trouble to nested lxc container check/restore/migration
> c) bring trouble to pid translation between containers;
> 
> This patch will show the hierarchy of pid namespace
> by pidns_hierarchy like:
> 
> [root@...alhost ~]#cat /proc/pidns_hierarchy
> 18060 18102 1534
> 18060 18102 1600
> 1550
> *Note: numbers represent the pid 1 in different ns
> 
> It shows the pid hierarchy below:
> 
>       init_pid_ns (not showed in /proc/pidns_hierarchy)
>               │
> ┌────────────┐
> ns1                      ns2
> │                        │
> 1550                    18060
>                           │
>                           │
>                          ns3
>                           │
>                         18102
>                           │
>                  ┌──────────┐
>                  ns4                   ns5
>                  │                    │
>                 1534                  1600
> 
> Every pid printed in pidns_hierarchy
> is the init pid of that pid ns level.
> 
> Signed-off-by: Chen Hanxiao <chenhanxiao@...fujitsu.com>
> ---

[snip]