linux-kernel - Re: Question: How to switch a process namespace by nsfs "device" and inode number directly?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 10 Sep 2018 09:02:01 -0700
From:   Andi Kleen <ak@...ux.intel.com>
To:     Chengdong Li <chengdong.li@...ux.alibaba.com>
Cc:     ebiederm@...ssion.com, peterz@...radead.org,
        kjlx@...pleofstupid.com, hbathini@...ux.vnet.ibm.com,
        brendan.d.gregg@...il.com, linux-kernel@...r.kernel.org,
        chengdong.licd@...baba-inc.com
Subject: Re: Question: How to switch a process namespace by nsfs "device" and
 inode number directly?

On Mon, Sep 10, 2018 at 04:50:42PM +0800, Chengdong Li wrote:
> Hi folks,
> 
> I am getting stuck by the lack of approach to switch process namespace by
> nsfs "device" and inode number in user-space,  for example (mnt: 0xf0000000)
> 
> From my best understanding, the normal way to do that is by setns system
> call. But setns only accept fd that refer to a opened namespace, sometimes
> we couldn't get it.
> 
> For example:  After perf record, perf report couldn't work well once the
> process that runs inside a container has exited, as the /proc/pid/ns doesn't
> exist anymore after process exit.

The kernel name space doesn't exist anymore at this point, so there is simply no way
to reconstruct it.

Perhaps would need some higher level side band data for perf, similar as what
is done for JITed code. Somehow the container run time needs to tell perf
where to find the code.

-Andi