From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752565AbcEMI3Y (ORCPT ); Fri, 13 May 2016 04:29:24 -0400 Received: from cn.fujitsu.com ([59.151.112.132]:20399 "EHLO heian.cn.fujitsu.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1752403AbcEMI3U (ORCPT ); Fri, 13 May 2016 04:29:20 -0400 X-IronPort-AV: E=Sophos;i="5.22,518,1449504000"; d="scan'208";a="6520654" From: Zhao Lei To: CC: "'Eric W. Biederman'" References: In-Reply-To: Subject: RE: [PATCH 0/3] Write dump into container's filesystem for pipe_type core_pattern Date: Fri, 13 May 2016 16:29:07 +0800 Message-ID: <001d01d1acf1$843d9820$8cb8c860$@cn.fujitsu.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 15.0 Thread-Index: AQLsP728qNIXty+I/nPfuJRMnr1l+J2BYwdA Content-Language: zh-cn X-yoursite-MailScanner-ID: A76A741B721B.AC1F5 X-yoursite-MailScanner: Found to be clean X-yoursite-MailScanner-From: zhaolei@cn.fujitsu.com Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org (Offline) Hi, Eric I rewrited patch to support code_dump in container according to your suggestion. Could you take a look of it, and give me your opinion in this version? Thanks Zhaolei > -----Original Message----- > From: Zhao Lei [mailto:zhaolei@cn.fujitsu.com] > Sent: Wednesday, May 11, 2016 9:27 AM > To: linux-kernel@vger.kernel.org > Cc: containers@lists.linux-foundation.org; Eric W. Biederman > ; Mateusz Guzik ; > Kamezawa Hiroyuki ; Zhao Lei > > Subject: [PATCH 0/3] Write dump into container's filesystem for pipe_type > core_pattern > > In current system, when we set core_pattern to a pipe, both pipe program > and program's output are in host's filesystem. > But when we set core_pattern to a file, the container will write dump > into container's filesystem. > > For example, when we set following core_pattern: > # echo "|/my_dump_pipe %s %c %p %u %g %t > e" >/proc/sys/kernel/core_pattern > and trigger a segment fault in a container, my_dump_pipe is searched from > host's filesystem, and it will write coredump into host's filesystem too. > > In a privileged container, user can destroy host system by following > command: > # # In a container > # echo "|/bin/dd of=/boot/vmlinuz" >/proc/sys/kernel/core_pattern > # make_dump > > Actually, all operation in a container should not change host's > environment, the container should use core_pattern as its private setting. > In detail, in core dump action: > 1: Search pipe program in container's fs namespace. > 2: Run pipe program in container's fs namespace to write coredump to it. > > I rewrited this patch from origional: > > http://www.gossamer-threads.com/lists/linux/kernel/2395715?do=post_view_ > flat > and changed the impliment way and function detail discussed in: > > http://www.gossamer-threads.com/lists/linux/kernel/2397602?nohighlight=1# > 2397602 > > Changes against previous impliment: > 1: Avoid forking thread from the crach process. > Suggested-by: Eric W. Biederman > 2: To keep compatibility with current code, if user hadn't change > core_pattern in container, the dump file will still write to > the host filesystem. > Suggested-by: Eric W. Biederman > > Zhao Lei (3): > [RFC] Save dump_root into pid_namespace > [RFC] Make dump_pipe thread possilbe to select the rootfs > [RFC] Write dump into container's filesystem for pipe_type > core_pattern > > fs/coredump.c | 19 ++++++++++++++++++- > fs/fs_struct.c | 25 ++++++++++++++++--------- > include/linux/fs_struct.h | 3 ++- > include/linux/kmod.h | 4 +++- > include/linux/pid_namespace.h | 3 +++ > include/linux/sched.h | 5 +++-- > init/do_mounts_initrd.c | 3 ++- > init/main.c | 4 ++-- > kernel/fork.c | 34 ++++++++++++++++++++-------------- > kernel/kmod.c | 13 ++++++++----- > kernel/kthread.c | 3 ++- > kernel/pid.c | 1 + > kernel/pid_namespace.c | 6 ++++++ > kernel/sysctl.c | 30 ++++++++++++++++++++++++++---- > lib/kobject_uevent.c | 3 ++- > security/keys/request_key.c | 2 +- > 16 files changed, 115 insertions(+), 43 deletions(-) > > -- > 1.8.5.1