linux-kernel - Re: [PATCH 0/4 v3] Add an interface to discover relationships between namespaces

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87fuorbevw.fsf@x220.int.ebiederm.org>
Date:   Thu, 22 Sep 2016 20:09:55 -0500
From:   ebiederm@...ssion.com (Eric W. Biederman)
To:     Andrei Vagin <avagin@...nvz.org>
Cc:     containers@...ts.linux-foundation.org, linux-api@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        James Bottomley <James.Bottomley@...senPartnership.com>,
        "Michael Kerrisk \(man-pages\)" <mtk.manpages@...il.com>,
        "W. Trevor King" <wking@...mily.us>,
        Alexander Viro <viro@...iv.linux.org.uk>,
        Serge Hallyn <serge.hallyn@...onical.com>
Subject: Re: [PATCH 0/4 v3] Add an interface to discover relationships between namespaces


Andrei Vagin <avagin@...nvz.org> writes:

> From: Andrey Vagin <avagin@...nvz.org>
>
> Each namespace has an owning user namespace and now there is not way
> to discover these relationships.
>
> Pid and user namepaces are hierarchical. There is no way to discover
> parent-child relationships too.
>
> Why we may want to know relationships between namespaces?
>
> One use would be visualization, in order to understand the running
> system.  Another would be to answer the question: what capability does
> process X have to perform operations on a resource governed by namespace
> Y?
>
> One more use-case (which usually called abnormal) is checkpoint/restart.
> In CRIU we are going to dump and restore nested namespaces.
>
> There [1] was a discussion about which interface to choose to determing
> relationships between namespaces.
>
> Eric suggested to add two ioctl-s [2]:
>> Grumble, Grumble.  I think this may actually a case for creating ioctls
>> for these two cases.  Now that random nsfs file descriptors are bind
>> mountable the original reason for using proc files is not as pressing.
>>
>> One ioctl for the user namespace that owns a file descriptor.
>> One ioctl for the parent namespace of a namespace file descriptor.
>
> Here is an implementaions of these ioctl-s.
>
> $ man man7/namespaces.7
> ...
> Since  Linux  4.X,  the  following  ioctl(2)  calls are supported for
> namespace file descriptors.  The correct syntax is:
>
>       fd = ioctl(ns_fd, ioctl_type);
>
> where ioctl_type is one of the following:
>
> NS_GET_USERNS
>       Returns a file descriptor that refers to an owning user names‐
>       pace.
>
> NS_GET_PARENT
>       Returns  a  file descriptor that refers to a parent namespace.
>       This ioctl(2) can be used for pid  and  user  namespaces.  For
>       user namespaces, NS_GET_PARENT and NS_GET_USERNS have the same
>       meaning.
>
> In addition to generic ioctl(2) errors, the following  specific  ones
> can occur:
>
> EINVAL NS_GET_PARENT was called for a nonhierarchical namespace.
>
> EPERM  The  requested  namespace  is outside of the current namespace
>       scope.
>
> [1] https://lkml.org/lkml/2016/7/6/158
> [2] https://lkml.org/lkml/2016/7/9/101
>
> Changes for v2:
> * don't return ENOENT for init_user_ns and init_pid_ns. There is nothing
>   outside of the init namespace, so we can return EPERM in this case too.
>> The fewer special cases the easier the code is to get
>> correct, and the easier it is to read. // Eric
>
> Changes for v3:
> * rename ns->get_owner() to ns->owner(). get_* usually means that it
>   grabs a reference.
>
> Cc: "Eric W. Biederman" <ebiederm@...ssion.com>
> Cc: James Bottomley <James.Bottomley@...senPartnership.com>
> Cc: "Michael Kerrisk (man-pages)" <mtk.manpages@...il.com>
> Cc: "W. Trevor King" <wking@...mily.us>
> Cc: Alexander Viro <viro@...iv.linux.org.uk>
> Cc: Serge Hallyn <serge.hallyn@...onical.com>
>

Applied thanks.

I didn't see any issues except your patch __ns_get_path was missing a
mntput in the retry case. So I just fixed that.

Eric