linux-kernel - Re: [Propose] Isolate core

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87fuyx1mfn.fsf@x220.int.ebiederm.org>
Date:	Sun, 20 Dec 2015 03:47:24 -0600
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Dongsheng Yang <yangds.fnst@...fujitsu.com>
Cc:	Al Viro <viro@...IV.linux.org.uk>,
	<containers@...ts.linux-foundation.org>,
	LKML <linux-kernel@...r.kernel.org>, <cgroups@...r.kernel.org>
Subject: Re: [Propose] Isolate core_pattern in mnt namespace.

Dongsheng Yang <yangds.fnst@...fujitsu.com> writes:

> On 12/20/2015 10:37 AM, Al Viro wrote:
>> On Sun, Dec 20, 2015 at 10:14:29AM +0800, Dongsheng Yang wrote:
>>> On 12/17/2015 07:23 PM, Dongsheng Yang wrote:
>>>> Hi guys,
>>>>      We are working on making core dump behaviour isolated in
>>>> container. But the problem is, the /proc/sys/kernel/core_pattern
>>>> is a kernel wide setting, not belongs to a container.
>>>>
>>>>      So we want to add core_pattern into mnt namespace. What
>>>> do you think about it?
>>>
>>> Hi Eric,
>>> 	I found your patch about "net: Implement the per network namespace
>>> sysctl infrastructure", I want to do the similar thing
>>> in mnt namespace. Is that suggested way?
>>
>> Why mnt namespace and not something else?
>
> Hi Al,
>
> Well, because core_pattern indicates the path to store core file.
> In different mnt namespace, we would like to change the path with
> different value.
>
> In addition, Let's considering other namespaces:
> UTS ns: contains informations of kernel and arch, not proper for core_pattern.
> IPC ns: communication informations, not proper for core_pattern
> PID ns: core_pattern is not related with pid
> net ns: obviousely no.
> user ns: not proper too.
>
> Then I believe it's better to do this in mnt namespace. of course,
> core_pattern is just one example. After this infrastructure finished,
> we can implement more sysctls as per-mnt if necessary, I think.
>
> Al, what do you think about this idea?

The hard part is not the sysctl.  The hard part is starting the usermode
helper, in an environment that it can deal with.  The mount namespace
really provides you with no help there.

Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/