From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754086AbcGHDgf (ORCPT ); Thu, 7 Jul 2016 23:36:35 -0400 Received: from mail-db5eur01on0110.outbound.protection.outlook.com ([104.47.2.110]:39552 "EHLO EUR01-DB5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753600AbcGHDg1 (ORCPT ); Thu, 7 Jul 2016 23:36:27 -0400 X-Greylist: delayed 1149 seconds by postgrey-1.27 at vger.kernel.org; Thu, 07 Jul 2016 23:36:26 EDT Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=avagin@virtuozzo.com; Date: Thu, 7 Jul 2016 20:00:56 -0700 From: Andrew Vagin To: James Bottomley CC: Linux API , Containers , lkml , , , "Serge E. Hallyn" Subject: Re: [CRIU] Introspecting userns relationships to other namespaces? Message-ID: <20160708030055.GC10512@outlook.office365.com> References: <87r3b7pxja.fsf@x220.int.ebiederm.org> <20160706141348.GB20728@mail.hallyn.com> <20160707133631.GA2994@mail.hallyn.com> <1467903712.2347.16.camel@HansenPartnership.com> <1467919055.2322.36.camel@HansenPartnership.com> <20160708021617.GB10512@outlook.office365.com> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="3MwIy2ne0vdjdPXF" Content-Disposition: inline In-Reply-To: <20160708021617.GB10512@outlook.office365.com> User-Agent: Mutt/1.6.1 (2016-04-27) X-Originating-IP: [67.183.159.197] X-ClientProxiedBy: CY1PR16CA0036.namprd16.prod.outlook.com (10.162.134.174) To DB5PR0801MB1431.eurprd08.prod.outlook.com (10.167.229.19) X-MS-Office365-Filtering-Correlation-Id: 2028d230-cd57-45fb-b605-08d3a6dc1e73 X-Microsoft-Exchange-Diagnostics: 1;DB5PR0801MB1431;2:zMwAj77PUer1sR9JAlYJKFntfuX0sZGwTVFJZaRrQ6zSuvP0CP/aZAxVoNKhvOEPTWmQ9yC6xydFdSrKeEJgRGds2XUxYcQU+fewBjWfY1NvAdRUwBRqbvwCXf1WcmLwCcDQEM35j81e5WMLclrOyslZNkVEl8YPYfepvFme6C26i4tmpmdasesqYcsnw6wW;3:GEgFCTqmUZECsLwyMsxRDDUehWmYCMp+SFCFK89NULxMIwjuvgfFuc3GqrVJsnPnqg6H16RgodsGNVGuuWOx2bZDHhafnoP+J+dmmA9sa3OPO1+lPmoFJZNvZoftno/P X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:DB5PR0801MB1431; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;DB5PR0801MB1431;25:W76iPAaDLh+HsvSpE5CJ343aT1UUK/Sif2hJoO4?= =?us-ascii?Q?QQ0S39uyohwvNzt8W2VHB3M1kfNxj4ov/3VNLiWfawF4KjqNNOClxZDzsDhE?= =?us-ascii?Q?2oxXZ9K40s7rymjzNSpxpoLhAOP+qItqSJIptFQrg4oENk6/Wk/xA6hu9Qos?= =?us-ascii?Q?9or6HI/P5qWDBMIuvHhyXByNpbfWtkE1Yfni/qwu0PUrV0G37pAx6ujGoRe5?= =?us-ascii?Q?1QCIKQmiwKsT4m8bC1S/FKH2tsLnSffSJ1jAx3Kkw5EUU2Q+cCOr3egrjXDG?= =?us-ascii?Q?zhBG3+oeFuwz+zh9mKm1/PmAVXFudVgrXt7ofNYUNgzRVXd0yWLNcRoyk8SP?= =?us-ascii?Q?PXyxjyZ+ITkCukpn8b5ZzjQueR8noumCxBCT1FPBcLQC2D5LBWhnWQB3DWpM?= =?us-ascii?Q?Zjzs+JENt6QsJrVgHJSOf2jTmuQG88T3kp3UrIHClYZNR9y8WBy5E5sIy8M1?= =?us-ascii?Q?a4lmf5ZyvxpbsSOuPcAfd3W/C6ucqq+C/K2VAsQY2sAGWx8iRSIIjxKyArA+?= =?us-ascii?Q?pbH5dj1IRSLFrNgjI3AoxiKhAK2RQcoWfu2ydWPLDjOoJGj4Zjwx1oKhsves?= =?us-ascii?Q?IR7brAsXtZXJ2lhnVI7asM86De/l3XiXXOq4isUn/prA+x5B2RfzQAgqAC2W?= =?us-ascii?Q?afzEwsp4vbHYo6FZwaskCN75szD4/48iTlZ4tWjl18omMijzZDCLGdI57xSg?= =?us-ascii?Q?6AsVn1CsdxY0+2/+R7r7fMXTWh6nSRkcK2cA76EqKi0ZJ0947bpCQj9iqcN9?= =?us-ascii?Q?aVgBz/NO0PSPW7hDYsGTrJTicGkuz9FFw1UGlRVC29IneK0r7t07odbiXO/X?= =?us-ascii?Q?+R4GsFuBZxLtJIngz3Fa4KYfOXsYFcxzXGUI+EUAV47mc7fohw8q4+SrFu4P?= =?us-ascii?Q?Crd9ojWLl36+aQe3E6/TrQx3Z0OXHmoGWGY6xB3teCzbbI4UF/BpXNcKTW3/?= =?us-ascii?Q?obiSjyEXpxznb4gN6xK3f5ln3DT4EuNMcuQ/kCXEEtMBFosqECWFa9SQD7nv?= =?us-ascii?Q?cl+flLchzBXegFU8YYpBwC0Wh?= X-Microsoft-Exchange-Diagnostics: 1;DB5PR0801MB1431;31:ZI5juImoaO5bFC0+sb3HjufmlYoyTxrYui+M5XoTglQgM65OIa6cIJ5fEISBL9He6CqYtYmN0u11QHFDC+Cdz0nTrWPS6ubvhYZt64OZuZOKko+YUrbLeHRqrXT6V+fSY+NGAkegOXev7stCdu4ChAoLTcT+k7FpxHm5FilAIH9n6oNKSQKbM9WxB0S0FA9rpuMdXpFb4AtFjheaOYoEZQ==;4:m2XxZpRlkzw74kM+QtLVcHqI5ObqF2n4yrZGhoY4hBlSJh5S6k2sUxzWA5gDocnSlFErC1O2xv/janjGD7IUPoFfJuLGvwGz7JwWi5kEqdBzW6ALBNt8Skmtit8fvdwRtj3oLLyQzvYNzRY8MN0lsQgruKpkSZ5BmBVRucOo1fFeVpidoy4HHtNtD49CBUAtiWma8/s9kSw6ywhZNz+PT3DGFIp9/rJwHLklP9Hyve9sD7y4tLk7kj9Xy5HI5OXmpsKueOgFoETN9HuFXUpCskHL2bO4HYv4QNQgl0N06lcBmv5yUohNJ5Z6plqNkL2rzI90OdA9lIp6q3uSn/ZlobPxSji6X05+PTEZSUwEl85/yVxlIsXtftGvfuqnWd46AgMDu9AvSYTKx42R1+YdC8k4dca9xeOrsEm4cN139U4uHnAAZ1hLl2Lzf4PixYyU X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(102415321)(6040130)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6041072)(6043046);SRVR:DB5PR0801MB1431;BCL:0;PCL:0;RULEID:;SRVR:DB5PR0801MB1431; X-Forefront-PRVS: 0997523C40 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6009001)(7916002)(24454002)(199003)(377424004)(189002)(93886004)(53416004)(97736004)(4001350100001)(189998001)(110136002)(4610100001)(86362001)(106356001)(66066001)(92566002)(33656002)(54356999)(77096005)(15975445007)(105586002)(76176999)(50986999)(101416001)(19580405001)(2950100001)(512884003)(83506001)(9686002)(568964002)(81156014)(84326002)(19580395003)(68736007)(5890100001)(2476003)(81166006)(7846002)(8676002)(305945005)(3846002)(586003)(6116002)(4326007)(2906002)(42186005)(574094002)(69596002)(1076002)(7736002)(18370500001)(2700100001);DIR:OUT;SFP:1102;SCL:1;SRVR:DB5PR0801MB1431;H:outlook.office365.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;DB5PR0801MB1431;23:R12M8I+boHtTxkD/GYM8VSKWPl3yCH0Kus847ay?= =?us-ascii?Q?jcg1zWbA5xT0Vo+G8LEwERVVVXzkXRJqjFV/2ArMkK6MDE8u1tEiNpjRiHqN?= =?us-ascii?Q?naL6v8vWjfuPNlscphjgCi+l3CctIc+Q9ISbm8DITgX6DS86XpIT5bHTolB7?= =?us-ascii?Q?4Spwh9/8szn2g6y+7N3aJS9K0Y1Xf+4Oqg8xVLJWAyAGT2UbQrWXxMsHNN1r?= =?us-ascii?Q?QuSlScAaGgQt4G5HxSkGlp4yhchmqeVxsi2+Hs9EqSBgVt6EcpAyR1/lBcTH?= =?us-ascii?Q?Ih6MNov+ptovF1VhHu+zQMt0TErayt2z9dkui5o9PFL05CYS/OC7uYspYT+0?= =?us-ascii?Q?7ITAiDJ5MznPoi2O8R2v+5v6rRDV0Flg7D/ERYyCTkjKj2BdZKhGgyi6CVAo?= =?us-ascii?Q?SJZ3Dtfv9CG5PeymTptz3Aexoi1rWCKAKBjYxfxnltVUXy+KXxqgniBVd/kr?= =?us-ascii?Q?fDzUZNRy+zeFSXShr0DA7tuTI5TmSE5eAGUXmi0FBSiba2OPlFpkq7AXIO1P?= =?us-ascii?Q?MmLQaIv2Pfz5rdQghmrtyYBcmlM4+h8C0/hTECjqZXQGY3me4YhtR+EC5y2D?= =?us-ascii?Q?+Ft0yeS4O8w8WIoh76Obsj7XjTOqHiDXROSppnSE3k2RTvLB5hxqNWUM25up?= =?us-ascii?Q?WIbcHuGPuyttjUs/dkmrmoEftJWKyYPRnqY2j7YMmbLjAUUSXmyOU2t3tm81?= =?us-ascii?Q?xlPvPys6PMdV5TsmCUY+QGaYzQGSZftdef4YTewKJcuggH+RJeRjLILutOi+?= =?us-ascii?Q?ph8MjfQtByFo6xxaPYVn5IjPqKXpaGtc9xxLxEuPZ9Lkvclg0dYU0nS+CIVW?= =?us-ascii?Q?1YriQBMnqbE2KLFIbUULstcSHo9W0m3gm51K218wLmklhOeMbxTUywsDYBAw?= =?us-ascii?Q?B/C0Lc0QFMVmzIvciV/Fo+/csWGAu/9XCLnEo8y6ErsGqh4q2qHajNGSxmQH?= =?us-ascii?Q?kGwFpVeqwWynovnDTYw/f6oLU2PtSPUtclHx7j0N0q3+JsS14zuUKJPB9S3S?= =?us-ascii?Q?phb2au2+HqrlV724TBifSmmm29NNmVIXjmfevqDkAqw4hyRGnpY5v56DmwRk?= =?us-ascii?Q?J8vQoHUvy2v1/PJf7hD3bQDJj4gWBcgtbtFOmEh6lJYSisKocriDJiHJDJN3?= =?us-ascii?Q?jNG2v88a3+Fxs1buLM/15M9zzS5DhLvuchyDTFrXEm39xtKRG3b5vWOik3l8?= =?us-ascii?Q?K4RYScOaX0MoW4di7gK+jCSRh17JmsXvUZg1C2QAFtI5dMR3y0ND8QZ2f0E9?= =?us-ascii?Q?gpVfA4gkCekuzTg/q/sbRu5CNgHQX1i+cBThDlauuB4CHUrV0r3DLSe1wnIz?= =?us-ascii?Q?gwAU9ucgNMu85AS5SfsKvR5/KbFw/9f72cm6MO6+pG7wY5UJKqZmNDyBnUWT?= =?us-ascii?Q?ljODxWw=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1;DB5PR0801MB1431;6:AXmNhk9R8jLMeuKhFzVXspn5mdv4Hmf4qZDcCiZpoqcE6SbJb88TkekWCUIY7lufp8FS/IDRpZ+fA7c96dk0IHctVt4X9zNHhVrFV/sUsHr+X+vpTkdkf3pwN6Khnnv1eTbChVPBfnFBrcVxhjZBj4wYCMz3pX/7KoWSexaXSYS7exz6gDhIyxXwidLHkVYjnlVZdFSArLZ3HwKjUBcCMeOiM/8m/4Op+AZ9HniN69LhodMVFlBzne9qlFUQfUp/oIIMVPAAyKiy8bEhS1Q8AOkMCcJGPMcU3I0/NTeoKByq44i4y6VPKLZXaZCog8WJ;5:pif59chbSNVgjzjkFFKR95Uc8ylAOTzFcqFf3VGtbwbouvW+RREtKklFB+JXRzFiDDxn3lPIZ4T1ZyxUzLHl/s1PHEPwR4RW05UXEqj+fpm71goXtCgJ60VPo3FeIhohJlQnU9JIEx4sWqz4e18L8A==;24:2fCBWLg+krwz6Ep4D6AwTODhYwVs9saRvBSiu9H5PSmZv+vP1OyBwv2IzsQn6JDOJqhrBeND/McORf1qxCUhB7JjKBMOmNXKuOjM+exbxPk=;7:Ip7RV7uZOjqBe56vcybwTsjVvmW7Tg+hOsBqXUq5mn6zt1kMWP3pasUaegGoLuQgcocIxkI8l1JRix3cRTduLnSXVuQHuZEgkem2bbqEJd3TahjlnDJjSfSQ5sIU5bPCiEXD0jeyZKch4/fDlFEmAkGDrV+Q8ga/aFA9PlNCX1p1Fi5OBxQLdFYfqzxHjGdPXQxepKKcoWwty7RFr9fILb/rWE9zuPmUaVbu4CcbzWy7QkRKuGa6AUF1r/pD4gqg SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;DB5PR0801MB1431;20:EoaUggSXMApx9aBBMCyyC44ZXg1XzQQXvDGjjKuUI4HUKX0ZDn7/TqujLYASmrXJ4rsQjF14GBqNAzIB5x/9ANCOBZCcKYVb2J1zGGWP0bCr/lGU7Hnj8X3Y++EZmuwatd6QRa5ScMT8orWK9MJD7tTNg7v/kK/1KLIfyXf2hx8= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Jul 2016 03:01:10.5192 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB5PR0801MB1431 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --3MwIy2ne0vdjdPXF Content-Type: text/plain; charset="koi8-r" Content-Disposition: inline On Thu, Jul 07, 2016 at 07:16:18PM -0700, Andrew Vagin wrote: > On Thu, Jul 07, 2016 at 12:17:35PM -0700, James Bottomley wrote: > > On Thu, 2016-07-07 at 20:21 +0200, Michael Kerrisk (man-pages) wrote: > > > On 7 July 2016 at 17:01, James Bottomley > > > wrote: > > [Serge already answered the parenting issue] > > > > On Thu, 2016-07-07 at 08:36 -0500, Serge E. Hallyn wrote: > > > > > Hm. Probably best-effort based on the process hierarchy. So > > > > > yeah you could probably get a tree into a state that would be > > > > > wrongly recreated. Create a new netns, bind mount it, exit; Have > > > > > another task create a new user_ns, bind mount it, exit; Third > > > > > task setns()s first to the new netns then to the new user_ns. I > > > > > suspect criu will recreate that wrongly. > > > > > > > > This is a bit pathological, and you have to be root to do it: so > > > > root can set up a nesting hierarchy, bind it and destroy the pids > > > > but I know of no current orchestration system which does this. > > > > > > > > Actually, I have to back pedal a bit: the way I currently set up > > > > architecture emulation containers does precisely this: I set up the > > > > namespaces unprivileged with child mount namespaces, but then I ask > > > > root to bind the userns and kill the process that created it so I > > > > have a permanent handle to enter the namespace by, so I suspect > > > > that when our current orchestration systems get more sophisticated, > > > > they might eventually want to do something like this as well. > > > > > > > > In theory, we could get nsfs to show this information as an option > > > > (just add a show_options entry to the superblock ops), but the > > > > problem is that although each namespace has a parent user_ns, > > > > there's no way to get it without digging in the namespace specific > > > > structure. Probably we should restructure to move it into > > > > ns_common, then we could display it (and enforce all namespaces > > > > having owning user_ns) but it would be a > > > > > > I'm missing something here. Is it not already the case that all > > > namespaces have an owning user_ns? > > > > Um, yes, I don't believe I said they don't. The problem I thought you > > were having is that there's no way of seeing what it is. > > > > nsfs is the Namespace fileystem where bound namespaces appear to a cat > > of /proc/self/mounts. It can display any information that's in > > ns_common (the common core of namespaces) but the owning user_ns > > pointer currently isn't in this structure. Every user namespace has a > > pointer to it, but they're all privately embedded in the individual > > namespace specific structures. What I was proposing was that since > > every current namespace has a pointer somewhere to the owning user > > namespace, we could abstract this out into ns_common so it's now > > accessible to be displayed by nsfs, probably as a mount option. > > James, I am not sure that I understood you correctly. We have one > file system for all namespace files, how we can show per-file properties > in mount options. I think we can show all required information in > fdinfo. We open a namespaces file (/proc/pid/ns/N) and then read > /proc/pid/fdinfo/X for it. Here is a proof-of-concept patch. How it works: In [1]: import os In [2]: fd = os.open("/proc/self/ns/pid", os.O_RDONLY) In [3]: print open("/proc/self/fdinfo/%d" % fd).read() pos: 0 flags: 0100000 mnt_id: 2 userns: 4026531837 In [4]: print "/proc/self/ns/user -> %s" % os.readlink("/proc/self/ns/user") /proc/self/ns/user -> user:[4026531837] > > > > > James > > > > > > _______________________________________________ > > CRIU mailing list > > CRIU@openvz.org > > https://lists.openvz.org/mailman/listinfo/criu > _______________________________________________ > CRIU mailing list > CRIU@openvz.org > https://lists.openvz.org/mailman/listinfo/criu --3MwIy2ne0vdjdPXF Content-Type: text/plain; charset="koi8-r" Content-Disposition: attachment; filename="patch" diff --git a/fs/nsfs.c b/fs/nsfs.c index 8f20d60..bfd5bde 100644 --- a/fs/nsfs.c +++ b/fs/nsfs.c @@ -8,8 +8,20 @@ static struct vfsmount *nsfs_mnt; +static void show_fdinfo(struct seq_file *m, struct file *f) +{ + struct dentry *dentry = f->f_path.dentry; + struct inode *inode = d_inode(dentry); + const struct proc_ns_operations *ns_ops = dentry->d_fsdata; + struct ns_common *ns = inode->i_private; + + if (ns_ops->show_fdinfo) + ns_ops->show_fdinfo(m, ns); +} + static const struct file_operations ns_file_operations = { .llseek = no_llseek, + .show_fdinfo = show_fdinfo, }; static char *ns_dname(struct dentry *dentry, char *buffer, int buflen) diff --git a/include/linux/proc_ns.h b/include/linux/proc_ns.h index de0e771..fed276b 100644 --- a/include/linux/proc_ns.h +++ b/include/linux/proc_ns.h @@ -18,6 +18,7 @@ struct proc_ns_operations { struct ns_common *(*get)(struct task_struct *task); void (*put)(struct ns_common *ns); int (*install)(struct nsproxy *nsproxy, struct ns_common *ns); + void (*show_fdinfo)(struct seq_file *m, struct ns_common *ns); }; extern const struct proc_ns_operations netns_operations; diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c index a65ba13..910b388 100644 --- a/kernel/pid_namespace.c +++ b/kernel/pid_namespace.c @@ -388,12 +388,20 @@ static int pidns_install(struct nsproxy *nsproxy, struct ns_common *ns) return 0; } +static void pidns_fdinfo(struct seq_file *m, struct ns_common *ns) +{ + struct pid_namespace *pidns = to_pid_ns(ns); + + seq_printf(m, "userns: %u\n", pidns->user_ns->ns.inum); +} + const struct proc_ns_operations pidns_operations = { .name = "pid", .type = CLONE_NEWPID, .get = pidns_get, .put = pidns_put, .install = pidns_install, + .show_fdinfo = pidns_fdinfo, }; static __init int pid_namespaces_init(void) --3MwIy2ne0vdjdPXF--