netdev - Re: [RFC][PATCH] ns: Syscalls for better namespace sharing control.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 27 Feb 2010 19:16:36 +0300
From:	Pavel Emelyanov <xemul@...allels.com>
To:	"Eric W. Biederman" <ebiederm@...ssion.com>
CC:	hadi@...erus.ca, Daniel Lezcano <dlezcano@...ibm.com>,
	Patrick McHardy <kaber@...sh.net>,
	Linux Netdev List <netdev@...r.kernel.org>,
	containers@...ts.linux-foundation.org,
	Netfilter Development Mailinglist 
	<netfilter-devel@...r.kernel.org>,
	Ben Greear <greearb@...delatech.com>,
	Serge Hallyn <serue@...ibm.com>,
	Matt Helsley <matthltc@...ibm.com>
Subject: Re: [RFC][PATCH] ns: Syscalls for better namespace sharing control.

Eric W. Biederman wrote:
> Pavel Emelyanov <xemul@...allels.com> writes:
> 
>> Thanks. What's the problem with setns?
> 
> joining a preexisting namespace is roughly the same problem as
> unsharing a namespace.  We simply haven't figure out how to do it
> safely for the pid and the uid namespaces.

The pid may change after this for sure. What problems do you know
about it? What if we try to allocate the same PID in a new space
or return -EBUSY? This will be a good starting point. If we manage
to fix it later this will not break the API at all.

>>> I have designed these file descriptors to pin the namespaces, so
>>> waiting for them to exit isn't something they can do now.  It makes a
>>> lot of sense to have similar ones that take  weak references to the namespaces
>>> that we can use to wait for a namespace to exit.
>> Yes, I saw this from patches. Eric, I'd very much appreciate if we
>> workout a solution that will allow us to kill two birds with one stone.
>> I do not want to invent yet another bunch of system calls for "taking
>> weak reference".
> 
> Definitely.  I only consider the current interface to be a mushy not
> set in stone.

OK. The interface is good. I just don't want you to send it for an inclusion
until we decide what to do with waiting.

>> As a "brain storm" start up. Can we use inotify/dnotify for this? 
>> Or maybe we should better equip the nsfd call with flags argument and 
>> add a flag for weak reference? In that case - how shall we get a 
>> notification about namespace is dead? With poll? Maybe worth making
>> the sys_close return only when the namespace is dead (by providing a
>> proper ->release callback of a file)?
> 
> We would want poll to work, anything else is a weird work-around.
> The challenging part is that we don't have any infrastructure for
> notifying when a namespace goes away.  So that has to be built before
> we can wire it up to userspace.  I don't expect it is too difficult
> but there is work to be done.

Poll is OK with me. As far as the notification is concerned - that's also
done in OpenVZ. If you are OK to wait for a week or two I can do it for net
namespaces.

> Eric
> 
> 

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html