lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20160311215010.GA5844@mail.hallyn.com>
Date:	Fri, 11 Mar 2016 15:50:10 -0600
From:	"Serge E. Hallyn" <serge@...lyn.com>
To:	Tejun Heo <tj@...nel.org>, lkml <linux-kernel@...r.kernel.org>
Subject: cgroup namespaces - mount root

Hi Tejun,

One practical problem I've found with cgroup namespaces is that there
is no way to disambiguate between a cgroupfs mount which was done in
a cgroup namespace, and a bind mount of a cgroupfs directory.  So
whether I do

unshare --cgroup -- bash -c "mount -t cgroup -o freezer f /mnt; cat /proc/self/mountinfo"

or whether I just

mount --bind /sys/fs/cgroup/freezer/$(awk -F: '/freezer/ { print $3 }' /proc/self/cgroup) /mnt

'mount root' field (field 3) in /proc/self/mountinfo will show the
same thing, the result of awk -F: '/freezer/ { print $3 }' /proc/self/cgroup.

I keep waffling between thinking this is a problem that needs to be
solved, and thinking "don't do that".  But docker at least seems to
have a problem with it right now, because it uses that field as part
of its calculation of paths to write to.

So, do you think it would be worth adding a 'nsroot=' entry in the
optional fields (next shared:) ?  I would've just sent a patch, but
it actually isn't quite as simple as it would seem to find a way to
get the absolute path during mountinfo_read(), so I thought I'd ask
before spending more time on it.

thanks,
-serge

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ