From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752032AbcGGNhJ (ORCPT ); Thu, 7 Jul 2016 09:37:09 -0400 Received: from h2.hallyn.com ([78.46.35.8]:44984 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751243AbcGGNhD (ORCPT ); Thu, 7 Jul 2016 09:37:03 -0400 Date: Thu, 7 Jul 2016 08:36:31 -0500 From: "Serge E. Hallyn" To: "Michael Kerrisk (man-pages)" Cc: "Serge E. Hallyn" , "Eric W. Biederman" , criu@openvz.org, Linux API , lkml , Containers , Andy Lutomirski , Tycho Andersen Subject: Re: Introspecting userns relationships to other namespaces? Message-ID: <20160707133631.GA2994@mail.hallyn.com> References: <87r3b7pxja.fsf@x220.int.ebiederm.org> <20160706141348.GB20728@mail.hallyn.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Quoting Michael Kerrisk (man-pages) (mtk.manpages@gmail.com): > Hi Serge, > > On 6 July 2016 at 16:13, Serge E. Hallyn wrote: > > On Wed, Jul 06, 2016 at 10:41:48AM +0200, Michael Kerrisk (man-pages) wrote: > >> [Rats! Doing now what I should have down to start with. Looping some > >> lists and CRIU and other possibly relevant people into this > >> conversation] > >> > >> Hi Eric, > >> > >> On 5 July 2016 at 23:47, Eric W. Biederman wrote: > >> > "Michael Kerrisk (man-pages)" writes: > >> > > >> >> Hi Eric, > >> >> > >> >> I have a question. Is there any way currently to discover which > >> >> user namespace a particular nonuser namespace is governed by? > >> >> Maybe I am missing something, but there does not seem to be a > >> >> way to do this. Also, can one discover which userns is the > >> >> parent of a given userns? Again, I can't see a way to do this. > >> >> > >> >> The point here is introspecting so that a process might determine > >> >> what its capabilities are when operating on some resource governed > >> >> by a (nonuser) namespace. > >> > > >> > To the best of my knowledge that there is not an interface to get that > >> > information. It would be good to have such an interface for no other > >> > reason than the CRIU folks are going to need it at some point. I am a > >> > bit surprised they have not complained yet. > > > > I don't think they need it. They do in fact have what they need. Assume > > you have tasks T1, T2, T1_1 and T2_1; T1 and T2 are in init_user_ns; T1 > > spawned T1_1 in a new userns; T2 spawned T2_1 which setns()d to T1_1's ns. > > There's some {handwave} uid mapping, does not matter. > > > > At restart, it doesn't matter which task originally created the new userns. > > criu knows T1_1 and T2_1 are in the same userns; it creates the userns, sets > > up the mapping, and T1_1 and T2_1 setns() to it. > > I'm missing something here. How does the parental relationships > between the user namespaces get reconstructed? Those relationships > will govern what capabilities a process will have in various user > namespaces. Hm. Probably best-effort based on the process hierarchy. So yeah you could probably get a tree into a state that would be wrongly recreated. Create a new netns, bind mount it, exit; Have another task create a new user_ns, bind mount it, exit; Third task setns()s first to the new netns then to the new user_ns. I suspect criu will recreate that wrongly.