From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753431AbcGHGzS (ORCPT ); Fri, 8 Jul 2016 02:55:18 -0400 Received: from mail-db5eur01on0101.outbound.protection.outlook.com ([104.47.2.101]:26624 "EHLO EUR01-DB5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751723AbcGHGzN (ORCPT ); Fri, 8 Jul 2016 02:55:13 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=avagin@virtuozzo.com; Date: Thu, 7 Jul 2016 23:54:54 -0700 From: Andrew Vagin To: "W. Trevor King" CC: James Bottomley , , Linux API , Containers , lkml , Subject: Re: Introspecting userns relationships to other namespaces? Message-ID: <20160708065453.GB14391@outlook.office365.com> References: <20160706141348.GB20728@mail.hallyn.com> <20160707133631.GA2994@mail.hallyn.com> <1467903712.2347.16.camel@HansenPartnership.com> <1467919055.2322.36.camel@HansenPartnership.com> <20160708021617.GB10512@outlook.office365.com> <20160708030055.GC10512@outlook.office365.com> <1467948407.2322.88.camel@HansenPartnership.com> <20160708052650.GM4916@odin.tremily.us> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20160708052650.GM4916@odin.tremily.us> User-Agent: Mutt/1.6.1 (2016-04-27) X-Originating-IP: [67.183.159.197] X-ClientProxiedBy: CO2PR04CA034.namprd04.prod.outlook.com (10.141.240.162) To AM4PR0801MB1427.eurprd08.prod.outlook.com (10.168.5.19) X-MS-Office365-Filtering-Correlation-Id: ab3f01a5-f1bc-4aa6-c821-08d3a6fccd7e X-Microsoft-Exchange-Diagnostics: 1;AM4PR0801MB1427;2:jNtVnrOiT7jmW9onFnNOL5qUoy2ACRokntHaHvunZTpn4c+6ghca/2SZLjhOWrPj+fOwSnFY7sq/k7l4X51Ww8gFPggP/NH0UM7b3nNxP6z/YTsRABYhp0RnFsx1gGx8B8yZc5q0y4GhBctVD3Nc7197kzmntx5nb46lR4y69xKC+BoAPmijF4pm6PTaXmPK;3:mAM3kyuEeZD5jMK4rGa+YS/UCMCiM7zjWQTnlZhFk+k/BAB7FsgrTaNMHikMhv32rR6diF75IaH1Oy8pAZ3N1jSLeeeLBxUrPSAwilQFoobjFvI1FUd8b3/5QP7APXlK X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:AM4PR0801MB1427; X-Microsoft-Exchange-Diagnostics: 1;AM4PR0801MB1427;25:FVMTutFpZLWnPOd7vRowWEwh6Hjw4GBbKqbHqvxOLL19er+hp/0fTNJ2PlOy8rHqFuc7Ab9Vkevl9bjpKFJH5+vN35SJCjzlHpylO8xDSkmypNlKNh5RJcGW2fNFaY44GtlhyGSQRANkFVWMmAUBhXZJ3ySVZasBd92beJEwvEPhtSUiVjq9wTYxyJYIPp4GKF/qPFNh48kFMNzrdi1objp0qvtF4Y6jQ9jdN/VDA07uHClBhZmaeXD03ArBkmcjMz+JQYr8ds1zJwo9ZOaNszAqXIF3fUMKI/AIE9hVlIypR1jvpbb1YyXuv3kWAlNZThtcs7LDrQzxW7xB43u8I7V7ncWHeibW6lezdoKHg28giXF8Hk5qADA9Pg8au5A06vrFKdare19PLrBOrZeluBCwEgJJs9BhkPSnvqVN8T4IMUUnxJQLEcxa0ENi3ngzDhevCZVGJRlc+860mxpPDoUU1UfUez+vVC0BPDAtN7QesBtd0XxDXlMr1kL88ha+1Njm9HB0bv0vTURfqkLfnLI9xQ+Ys8WJBKX7IXMaFiTg1RJsEzaKTnVivcG3ctnJGGICY60xxQt8RRFy7+pjY2YaART9zL9qNmMVWLVsEsop+E/TZc2PIVEbi13vGgWJS2ON53NpJ+G3oo9uT29QA50UOIwMLHAOBk/CyiU6z+egGrgpicJCr1UtwzAYtzAzfMsuVJMW0vffX1zREmvTHyoYc3EjTiP3cp+tmnLuBB1vxuBNa7SraHpLbxURYRDofkGm0CEo9lTDhy9vTbPwjn1gp6R8H/BVyUl0VHtOEWQy2Xx8BP1X2Ex35uSD+u4nnPCpvqBO4f+rMCWNO2QoGw== X-Microsoft-Exchange-Diagnostics: 1;AM4PR0801MB1427;31:D45MPRnt00V/lHbaWPIkq4QSqUlojA+1rYjinK0fRuG9ffVNKjwehtUTO26ZVcCkVo3vI7u9SWY35xe9Cp9jQR5c0bXKtK5uSxyJrQPpGKtWBoC3CW1bX0S8J9Xj1UyN05CpQ7C+wEYMIbnROKC+XZGonlxnhowCqab+PlbeUbM4d/DILi1HuPOgyPOMSq1gFWui6zfVMl8nBQUMcP0DfA==;4:lLpV05f7NzsXDFaJCduvQaDSTXrjo/eJ+TvxXnvj8bnWyLUSCfnsSIjNPN+Tkcck9tPLyGm9vZXb2Sc2Aso8j+4bdxYDTOwCm2Dt0kGWkiVei72Q8qXHZOpi3ViSy17Q7RVC4lGpG3GKjV5DbBWsFsDI7GNRpuc9oth6Jv5avaQvENpfPtP3SF6CXJp6POqwoa3qt/WEUYINvurVz1x3y8o8W1uqdInJzH5l0lYf1HvBSnrcNKPBBypf0jlLfwF6CQMhLHyM4kKE8ug4sXYfK3+jPJHn6+Cnnx5ZWUftIgTfNjd6IsmRdl9wB6QBDWMexEO93GmyHWOcjAD/+FINXHS+PM6BBLEEAVsBYqNrIGde+oV+cYxFs3I1zvjspNxoQ4aJ8d3xlF+hTBnHwSaa0X1Zow3O0C09i9AWMy3io9fRA/79vMzyHSc9V9L5v0X3uWHh430J/AHPvh64QRlEvw== X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(170618885588394); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040130)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6041072)(6043046);SRVR:AM4PR0801MB1427;BCL:0;PCL:0;RULEID:;SRVR:AM4PR0801MB1427; X-Forefront-PRVS: 0997523C40 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6009001)(7916002)(199003)(189002)(377424004)(24454002)(76176999)(101416001)(86362001)(50986999)(23676002)(33656002)(19625735002)(47776003)(66066001)(93886004)(19580395003)(105586002)(54356999)(83506001)(19580405001)(2906002)(15975445007)(9686002)(2950100001)(68736007)(1720100001)(7736002)(7846002)(77096005)(2870700001)(4001350100001)(106356001)(110136002)(69596002)(50466002)(8676002)(305945005)(189998001)(97736004)(586003)(1076002)(42186005)(53416004)(3846002)(81156014)(6116002)(81166006)(92566002)(4326007)(18370500001);DIR:OUT;SFP:1102;SCL:1;SRVR:AM4PR0801MB1427;H:outlook.office365.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtBTTRQUjA4MDFNQjE0Mjc7MjM6Z1RmeVFTSDAyNys3N2plNUZqeldRM3hk?= =?utf-8?B?WEE0bFRFUi9NYlJ5ZTV3clM3U0FzdmIraEFITHZISGJRZ2lBSGhDbkdvSklB?= =?utf-8?B?WjROSFU0RUs2SDFJY01EalJKQkJISjl5cjRscVcvZlQ4eWxaeEJqYVpvZUxZ?= =?utf-8?B?cVRTMlU5cHBuYmlCMmZFa1BrQjVkbDdPK3NSMlhIcjZGK3A4QzlETjhMd1B4?= =?utf-8?B?aVpvZ2VrQXZIRDNLb1hHZ2pwQlRlOG5VcTltcGFXd0llekh6TWJ5V2FTWFhZ?= =?utf-8?B?bFlKdXV1R0dOdTMxRzVYaE90WUE1OTMwVlA5Qlg1Tnk4MkpvUGN1S0crUXBD?= =?utf-8?B?N09OaUF1Z29xOXI2Rm9iangvcXdlVk1IaW11aTJPWkhadklraWtWL0RhQ0xN?= =?utf-8?B?ZERnVFZtc1hEdVE2d1RSZ20yWVdXTFlCMmdmOHZKMGt1aFA2dHNiNmFxTURU?= =?utf-8?B?aSs5Q2ZYMXRFSVpGOGdHOTJnQ2FrTTdPNGNFaUJKWGFnc0srbHlJbmtOMWM1?= =?utf-8?B?TUhGY2NCRmZPYXBoUDNXRlQzbktQVkJvZmNIN09HRmw4VkdYZG1QakNBdm5Q?= =?utf-8?B?OE5RTzdBb1JlazE5aTI5WXZaNjFXUWdSdmhBQzRQYjBaWi8yY05UcjlNUTFR?= =?utf-8?B?UG5qVVd3Y0k0LzBRWWlxUDhhSUt1UXRDWThabjBEZHhIMllvaE0vSUNRWHhC?= =?utf-8?B?ek50MEdNLzN6aE1NbXcwNERPZ1pHc3RxaFUwQUxGUnB0aVpaOXV5TlltQVJ2?= =?utf-8?B?RndaaEgyRkw0SzJRd3duZE83bTBRVjhIcmtOYWRyaWtJVDVjS0t4UTA0ZkU5?= =?utf-8?B?MmdsSHFQWXJrR0Y0bUp6YVpFcFFCaU4vWHIxeXBmYlFZR25VZzNVMWN6MzY1?= =?utf-8?B?RU9tMWdXYTVpMTVYL2YrMEl6WTJ3MWtlWWVrNXN6VEM3SDZaVkJwZEc3RXZW?= =?utf-8?B?bm5EUW50anNnQ2Vyd0lscEIzK2lJMDl1bVIzcFo0NzkrZ0w3YnlHYlBvNjQ0?= =?utf-8?B?Vkk5ZHJESm41K2x1NjBTZUt0dHRoUFRVZ2ZuU2kvV2NBMDI4Vyt4eTlHTXQv?= =?utf-8?B?bHlMMjJER3hrOUFySHJFQ0FyTkNIenZ3WDYxMTBWclA3T204TmQyR095eWxC?= =?utf-8?B?WStjcGRLZlVQQUMweTlDNGU5RjE4TTVEUktvckRSU2lueW5jbHFxNjNOcGZT?= =?utf-8?B?TXZBSFRLNkhXV3d4a1FGWmxhZmVLRzFSYzVIaHEzQkFKeElkSnhLblBoeWZI?= =?utf-8?B?UUF2MWNQZmg3SG44WWNPZFFGMmFBb0kxeWNMWTAzRGRJTmI4Z1FCUXpSNDVZ?= =?utf-8?B?OGc3a2dsSFZWaGlKb2ZXOG1Ud2pJRmxHb3l1UzJWbVJGYjVkTkIyZFZUYi9E?= =?utf-8?B?R08rL013Nmg4bXpEMmd3QWFHWVhKSTdzOFgxbnVxdThqOXFQTDF6TzJrZHl3?= =?utf-8?B?K2lzSUw0eWdoeWl6emtMeUxHWE9zeWhJNWZRT2Vob1p0RGRHZU5qRjNwNGRu?= =?utf-8?B?QkRIaHQ5UGFXYys0ekJJM1g5ampHazhXamRRMUFiaGtLNXV3YWphY0Q4RnM4?= =?utf-8?B?eTJhZkNrT1JxbGpIcW9jaldJc3RJZm9BeGJxSTFkMnBlTlZ4M2hqMlFhSGpU?= =?utf-8?B?T1N4SHZXVHRxODVpVmhzZndjWE9sOTRROXNjakpVb2w4MGM3THN6QTVNTndy?= =?utf-8?B?ZWd3QU0vVnBMR3A1K2JuaHd1dlo5QXd0dDlJMThJRGtCU0RveEw0UVlkbmhV?= =?utf-8?Q?Twga0xJpqPxxdZQo81HKcroNp80E2K5BiWE8B4g=3D?= X-Microsoft-Exchange-Diagnostics: 1;AM4PR0801MB1427;6:4fmaYc+nTVsrB+cgNIr1EEOrjQNAMwzo5O0HEnjI/UWFZWubEb7Exu0RvqksSnBFgeRr7ox9beHL1iEh6/GAWMnZLXRqb+NAABBXiYC7Ooa07HcXCMUTHbSyv4Eby17VxUJG5EyDSvOtRlHD/hpxFOvsUVt+7YxV3p/19xrqH70PdImzmC1D83JmZ5sHuMRNUxTjmJBAOytjH/GfyGWoieNhkA/+OoWsb9PbIhkXWYXErib8OVUPjIXC/EsUuDozp0SqSU9EIYC38w/u9eh8IfCX6iLUh5Sehjzmx4khvI3SRNoB9xNxE3P0XKx/fT0Q;5:iKkrhL1DewMMXj0wgA+fe927gvgOI5Po/oEwmmziCPmBOxgx1uutTIeAKkxMs73rI4KqDzFT8vfPDNp/3PwxuvjMwm9NQ8N07qYu/kclHA/p7+58ZvPFM6uWMO9eoE8zpOqQVSPg2flWu1lR8NIWCw==;24:bAdDHyKeo4j0NzScrKwKbX0eL7yitaz6j8IP1wHg/XmuJ0Sm2MrNP3Kj769+hXfLEc4iX3p17wAb9qS2OeikaNlNcTk4VnEHwAR/XF6Tfdc=;7:gxeSbSLnMGJjZttnMV+BHVUwL5rJYVOg1DaTCgVharox8A7VOs0+LnDEBtqgyR220WhD3O3O2IZNmNKFNX9OIcEhL1wEek9/eG14jbkcCHEr7aalO6lT7P6Qq/2mZL0OHBdPHRQ1Alv+cjAYAUvLytc1hG8s0gEiSuvcpuRpHABTSZaQH/Qg+ZBeB4sNq+ZIqpWusHPHW8DmlClWh2NZD+9x//Igf5RQAe0Atd/+fnl7iR/ZWO3xqOW9wBbrHr5h SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;AM4PR0801MB1427;20:Indh5rWMtAsRz42CJHrE7rvsbJ3fj8lTU6U/b8vEeycsh/mP7LlSC2E2ptwR0W5pbK610S2FP52MFImnbVZIVc/7i3dAx1wVJLIh1xsAm86vfvruJu5TBhCoZjtI7XZIzcRQwB3dRnbLPC+Ldr8XRKmqKf8Kp/QuH5/KLPyIm94= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Jul 2016 06:55:08.1615 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4PR0801MB1427 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Jul 07, 2016 at 10:26:50PM -0700, W. Trevor King wrote: > On Thu, Jul 07, 2016 at 08:26:47PM -0700, James Bottomley wrote: > > On Thu, 2016-07-07 at 20:00 -0700, Andrew Vagin wrote: > > > On Thu, Jul 07, 2016 at 07:16:18PM -0700, Andrew Vagin wrote: > > > > I think we can show all required information in fdinfo. We open > > > > a namespaces file (/proc/pid/ns/N) and then read > > > > /proc/pid/fdinfo/X for it. > > > > > > Here is a proof-of-concept patch. > > > … > > > In [2]: fd = os.open("/proc/self/ns/pid", os.O_RDONLY) > > > > > > In [3]: print open("/proc/self/fdinfo/%d" % fd).read() > > > pos: 0 > > > flags: 0100000 > > > mnt_id: 2 > > > userns: 4026531837 > > > > > > In [4]: print "/proc/self/ns/user -> %s" % > > > os.readlink("/proc/self/ns/user") > > > /proc/self/ns/user -> user:[4026531837] > > > > can't you just do > > > > readlink /proc/self/ns/user | sed 's/.*\[\(.*\)\]/\1/' > > With Andrew's fdinfo approach you know the user namespace owning > /proc/self/ns/pid is 4026531837. That happens to be > /proc/self/ns/user in this case, but doesn't have to be in general. > > > But what Michael was asking about was the parent user_ns of all the > > other namespaces ... I don't think there's any way we can get that > > out of any information in /proc/self/ > > If fdinfo only shows immediate parents, you'd need to walk the tree to > get back to the root. And at each layer of the PID namespace tree > there will be another user-namespace parent branching off). With a > tree like: > > Namespace | Parent | Owning userns > -------------------+--------------+------------------- > Root userns | - | - > Root PID ns | - | Root userns > Child userns | Root usens | Root userns > Child PID ns | Root PID ns | Root userns > Grandchild userns | Child userns | Child userns > Grandchild PID ns | Child PID ns | Grandchild userns > > Walking from the granchild PID namespace would give you: > > Grandchild PID ns > |-- Child PID ns > | |-- Root PID ns > | `-- Root userns > `-- Granchild userns > `-- Child userns > `-- Root userns > > If you only put one level in fdinfo, you're stuck if one of the > namespaces involved has neither bind mounts nor a PID to give you > handle on it [1]. And if you want to put that whole ancestor tree in > fdinfo, you have to come up with some way to handle the two-parent > branching. I think it's a bad idea to draw a tree in fdinfo. Why do we want to know this hierarchy? Probably we will want to access these namespaces (setns), in this case we need to have a way to open them. Maybe we need to extend functionality of the nsfs filesystem (somethink like /proc/PID for namespaces)? > > I'm also not sure how exposing nsfs information [2] would handle > namespaces that had neither a surviving bind mount nor a direct > process. > > If all the information is available (possible after a mechanical patch > [3] makes it more accessible), then it seems easier to put it in a > separate /proc or /sys file. There was a stab at this for PID > namespaces in [4] (the same series that landed NStgid, etc.) with > additional background and alternative approaches in [5]. There were > problems with that patch (and it was trying to do more by also listing > a process's ID in each PID namespace), but the “let's put the whole > tree in a new file” approach seems sound to me. > > Cheers, > Trevor > > [1]: http://thread.gmane.org/gmane.linux.kernel.containers/30456/focus=20536 > Subject: Re: Introspecting userns relationships to other namespaces? > Date: Thu, 7 Jul 2016 13:24:42 -0500 > Message-ID: <20160707182442.GA6402@mail.hallyn.com> > [2]: http://thread.gmane.org/gmane.linux.kernel.containers/30456/focus=30499 > Subject: Re: [CRIU] Introspecting userns relationships to other namespaces? > Date: Thu, 07 Jul 2016 20:20:05 -0700 > Message-ID: <1467948005.2322.84.camel@HansenPartnership.com> > [3]: http://thread.gmane.org/gmane.linux.kernel.containers/30456/focus=20537 > Subject: Re: Introspecting userns relationships to other namespaces? > Message-ID: <1467903712.2347.16.camel@HansenPartnership.com> > Date: Thu, 07 Jul 2016 08:01:52 -0700 > [4]: http://thread.gmane.org/gmane.linux.kernel.containers/28925/focus=28928 > Subject: [resend][PATCH v9 1/3] procfs: show hierarchy of pid namespace > Date: Tue, 23 Dec 2014 18:20:37 +0800 > Message-ID: <1419330039-29207-2-git-send-email-chenhanxiao@cn.fujitsu.com> > [5]: http://thread.gmane.org/gmane.linux.kernel.containers/28105 > Subject: [RFC]Pid conversion between pid namespace > Date: Thu, 3 Jul 2014 12:18:33 +0000 > Message-ID: <5871495633F38949900D2BF2DC04883E55C374@G08CNEXMBPEKD02.g08.fujitsu.local> > > -- > This email may be signed or encrypted with GnuPG (http://www.gnupg.org). > For more information, see http://en.wikipedia.org/wiki/Pretty_Good_Privacy