linux-kernel - Re: Question: How to switch a process namespace by nsfs "device" and inode number directly?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 12 Sep 2018 10:05:27 +0800
From:   Chengdong Li <chengdong.li@...ux.alibaba.com>
To:     Andi Kleen <ak@...ux.intel.com>
Cc:     ebiederm@...ssion.com, peterz@...radead.org,
        kjlx@...pleofstupid.com, hbathini@...ux.vnet.ibm.com,
        brendan.d.gregg@...il.com, linux-kernel@...r.kernel.org,
        chengdong.licd@...baba-inc.com
Subject: Re: Question: How to switch a process namespace by nsfs "device" and
 inode number directly?

Thank you, Andi!

Yes, that's a situation, also it's an important one I guess.

Another case is that a process running inside a container has exited but 
the container still alive.I think this is also a common case. The 
potential fix solutions I am thinking are following:

- Using nsfs "device" and inum. This is why I am asking for your help. 
As we already have nsfs "device" and inum of each thread at least.

- If the current thread has exited, it's probably the parent thread and 
the leader thread of that container are still alive. If we could have 
those threads' pid, then we could use setns.


If the first item is not doable, I would like to try the second one.


Thanks,

Chengdong

在 2018/9/11 上午12:02, Andi Kleen 写道:
> On Mon, Sep 10, 2018 at 04:50:42PM +0800, Chengdong Li wrote:
>> Hi folks,
>>
>> I am getting stuck by the lack of approach to switch process namespace by
>> nsfs "device" and inode number in user-space,  for example (mnt: 0xf0000000)
>>
>>  From my best understanding, the normal way to do that is by setns system
>> call. But setns only accept fd that refer to a opened namespace, sometimes
>> we couldn't get it.
>>
>> For example:  After perf record, perf report couldn't work well once the
>> process that runs inside a container has exited, as the /proc/pid/ns doesn't
>> exist anymore after process exit.
> The kernel name space doesn't exist anymore at this point, so there is simply no way
> to reconstruct it.
>
> Perhaps would need some higher level side band data for perf, similar as what
> is done for JITed code. Somehow the container run time needs to tell perf
> where to find the code.
>
> -Andi