linux-kernel - Re: [PATCH resend] kernel: Make taskstats available via genetlink per namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220223045639.1932955-1-xu.xin16@zte.com.cn>
Date:   Wed, 23 Feb 2022 04:56:39 +0000
From:   cgel.zte@...il.com
To:     ebiederm@...ssion.com
Cc:     akpm@...ux-foundation.org, balbir@...ux.vnet.ibm.com,
        bsingharora@...il.com, cgel.zte@...il.com,
        containers@...ts.linux.dev, deng.changcheng@....com.cn,
        linux-kernel@...r.kernel.org, xu.xin16@....com.cn
Subject: Re: [PATCH resend] kernel: Make taskstats available via genetlink per namespace

>> -sh-4.4# ./getdelays -d -p 186 -v
>> print delayacct stats ON
>> debug on
>> Error getting family id, errno 0
>>
>> As more and more applications are deployed in containers like Docker,
>> it is necessary to support getdelays to be used in net namespace.
>> Taskstats is safe for use per namespace as genetlink checks the
>> capability of namespace message by netlink_ns_capable().
>>
>> Make taskstats available via genetlink per namespace.
>
> Let me add a polite nack to this patch.

> Taskstats is completely senseless in a network namespace.  There is no
> translation of identifiers into the context of the receiver of the
> message.

The interface of taskstats is genetlink that is sensible in net namsespace.

> To make this work requires updating the taskstats code to do something
> sensible when in a pid namespace, as well as when in a network
> namespace.

Yes. Taskstats already does convert the input process ID into the task in the
correspoding pid namsespace. Do you mean to add some check of current user's
capability like SYS_ADMIN or else?