From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752152AbcHPXP6 (ORCPT ); Tue, 16 Aug 2016 19:15:58 -0400 Received: from mail-db5eur01on0093.outbound.protection.outlook.com ([104.47.2.93]:47105 "EHLO EUR01-DB5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753240AbcHPXP4 (ORCPT ); Tue, 16 Aug 2016 19:15:56 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=avagin@virtuozzo.com; Date: Tue, 16 Aug 2016 15:44:07 -0700 From: Andrei Vagin To: "Serge E. Hallyn" CC: Kees Cook , Andrei Vagin , "Serge Hallyn" , Linux Containers , "Eric W. Biederman" , LKML Subject: Re: [PATCH 1/2] kernel: show current values of user namespace counters Message-ID: <20160816224406.GA20375@outlook.office365.com> References: <1471291822-539-1-git-send-email-avagin@openvz.org> <1471291822-539-2-git-send-email-avagin@openvz.org> <20160816200529.GA1280@mail.hallyn.com> MIME-Version: 1.0 Content-Type: text/plain; charset="koi8-r" Content-Disposition: inline In-Reply-To: <20160816200529.GA1280@mail.hallyn.com> User-Agent: Mutt/1.6.2 (2016-07-01) X-Originating-IP: [162.246.95.100] X-ClientProxiedBy: BY2PR02CA0048.namprd02.prod.outlook.com (10.141.216.38) To AM5PR0801MB1972.eurprd08.prod.outlook.com (10.168.158.11) X-MS-Office365-Filtering-Correlation-Id: 0ce19988-e41a-4de2-7b39-08d3c626e004 X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB1972;2:LGmkwldd0kymT76v6R9P6veOXDuSh6SsYZmsFciPfH++kT2Snn2fFW7f0EVG8/EhcrPAez6QyqOdmU/3TeWiHyzle9ANCXmIc6c16pzQkwMO6TezzA0iOvTwwCs4JQmdcNuF+m/LQmLXbQJji2ED2neCFImFrRB+ceSLqQEQHVn1+LqZcrP1dwQUEXU4Z+E+;3:kcrsHnmsxaK75RAI070PG/TqTWzohF7oBz0WS7CdyzBI5WsQRbOKTHlm8JxFu/+cTkD0Pr+umXDrrfRXmKG5IMeGVD14AxIDCg+q1fHfqBSetLOoRplV1oDTTW4HY3Y3 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:AM5PR0801MB1972; X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB1972;25:mTfxqaSPYt4SBj1kza0cgszGJB8IjH1iKHiRD0eC5ukO2hh9eLIOrD6LgBsIBEAN+Jl/D8+OBRqQTv94Ah90meVNtcoBjNprbykXwKWI3N/uK3h5k9BnG4pqNtpy+7YxHcYjmBi96NdK/K4oeVeMw6ZG8yhPziyAb/oUoIuQ/iZWLAQwLewimBBwcurKCOqE4/n8VXwCaghPvdqhUUR4tOyHIun3ft7i7C5fkm5Fhg8KoGRoO4nfzDCkTrunZrp10OGSXBmc0pNe/Ct4RdJrP/ZXYvtopXLmISu0j041u2beBnN1+usxcnvvIUdqqFHkRTLsGsf2/uELsB6xctMVeW4Y/RFQc8HL1PJ5yTlAkXGIiXnLxGWuPzrHLdDfMXgpk7OlWIBXo6OfjBjhktgUcE7kHtg6EM7YIZBEE+o4zkdOZSi8pkQ1GrqL7F7GzURqmSjtMoF+iC9YpvTL/HW8J9QUEeKMG11u3+pJkVhhT4JQiKNi+Xs0GDgDmo4jZdqyQcnZ/FZO5HduTKjf5iTXuSTm0rYhT/D3RmxuaW7AfTBWq08aIlMoBeb6zEQzFspjfKHS2Xx1nM8r9IG7LSeP1G4jHtMn+7Yir/4GjxUg7r9C2mxL8Ia++00qNc37oUUJhjbvKXY/p+zLF1ksnl4ZYABmAF78ik/6gtLIvobw1yoswp+ikjoF515O7mwGvo3zVzUNQIpLjgE+SrYLHBIipw4usNGacWxuv2jmmepB6rIoXQonBKddzvawflevFFeZP9XDmtBq8X4Xr5MawIEqWGGOKWdzsKO3Qh7ejnlOC0k= X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB1972;31:1VRFYNSNP3+nKWkPL3U8/pLLOhAeQyfZC0uqi/0JFFTlIsksMVPwJsevht5ZttrgxWR0aJ9AIZ2NDyouywMtPZbdz0jsBJeRel4pIsGAZnH1Z7y96QNy771N0YAF2nGzwiJsI0Vl3CQ+J1D/5SABqBCBc5Zbar/kM8EQL89F5Mp7LS08WYiILtDlYC/LcVZPB4PhaKWqOBSLYO1FjAb9Kz0AAPRwOOrq/mjDD7V2bOY=;4:iSKcEiNtiWVEpHe3B6JP7HNzOeFXwtweEad/DOACRQV6GykmgrXT8JpJcpGaJYWt7WewtSoKZyteI7UC6rgu5hyaJdW3VfEscHBmbq62hFwj0eQ3Ft9DXQIbRc5CiFINNJw3CdYS9TDkJkJUh3U9Uo+NjhO4jCsSrijBheceR6wHhEJsDsqTR4e6EcxnbRdvjN6cdv4qypMs7zm1o1689B1XgvrrYIxxIxSLCq6rh0RbD4eb8TVfIQ2rU6/zWRP9a0AeScZ9GSLlw2GeD9RtGHAAJsi4eEOx0bM0Su0osClJONZTCwA/mxx3NmojiuehP0sThM0IzmbrqpKVN+gIPbDEmeaMQheyK8mfnJOVzHno4FhvzVgD0Bc+86ttLeE0kooZHHGuYtihr5Bf401uVhidQJYTYxv3nk5Is06S3ZqWVbyuMfApIUBmMrrQgtTik8Jc9ROsnzKfOqAa1WUd9nwnB7HQEAHoW1Jq4VJTKNk= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(198206253151910); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040176)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6042046)(6043046);SRVR:AM5PR0801MB1972;BCL:0;PCL:0;RULEID:;SRVR:AM5PR0801MB1972; X-Forefront-PRVS: 0036736630 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6009001)(7916002)(24454002)(189002)(377454003)(199003)(53416004)(77096005)(50986999)(81156014)(8676002)(106356001)(42186005)(81166006)(2906002)(3846002)(586003)(93886004)(23686003)(9686002)(76176999)(1076002)(68736007)(83506001)(69596002)(305945005)(105586002)(7846002)(7736002)(4326007)(54356999)(4001350100001)(92566002)(6116002)(86362001)(19580395003)(189998001)(97736004)(50466002)(110136002)(19580405001)(101416001)(33656002)(66066001)(47776003)(2950100001)(7099028)(18370500001)(26326002);DIR:OUT;SFP:1102;SCL:1;SRVR:AM5PR0801MB1972;H:outlook.office365.com;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?koi8-r?Q?1;AM5PR0801MB1972;23:6vSqejnfgvdQkQTxQ8exEVCMqmTpJXKVAnzmxewMB?= =?koi8-r?Q?ooHpDY0GSkLjN/0YuUAsDNeA/f5gdNsvvnKC6aUElxTBgKufUQLUG0TrhgQeml?= =?koi8-r?Q?pG+ujP7dmqBwX+yNi+pgy0jdBSAj7KHtvXHwEDZmmju3nS4Fu8edLUbl/mlo3m?= =?koi8-r?Q?AVWZmeQISa1jO6hqm0C6oh8F4CnN0sctd89BZnw4jpF3xX/nW4QC6cyazciRwd?= =?koi8-r?Q?y22OGGwGPMxkyxZNX+ficXBHFRfjKlcGBeqLsnLiPFv84wOB2GTr5xx+GgIY3c?= =?koi8-r?Q?wf8FSvSnloX91hMYggDe81OA7OWjr66PgkIubhyWPvFJ+JKgaf4UEPIG3sX9Pq?= =?koi8-r?Q?xO2NoFg/jjQAol0xnQ8CBH4B04ZM5RBsUiyCD9mCF4aTCm6ZSkSw8eUC9bOv6m?= =?koi8-r?Q?Rho2ATJwpkNE4izBsijY9XalP4A62CRbA7GX5PdXt321SGN0lsrY0hd2nH4wGm?= =?koi8-r?Q?vJVin6koyFf9OeQOc3qdjgLMwfKZJIG5NiqmucHtiuT1Ic2Oa5MGLkTQu1Cgk2?= =?koi8-r?Q?TxncbOuOFFlUXmY8nibQ2nmEjaP4UKaeIaTQx9G9TqBHdmAmNa3Zfj8n8CyMmr?= =?koi8-r?Q?LrU5y5TvvbgZIMUtNw+l3jHkY41JumON/AITfGnrKTKVteisxIMgdKOuEyeK8n?= =?koi8-r?Q?S6Z9kqfwJQX3xVLtVadrlil2A3g25HUAgnEq6N0DvTXZbZQExlFVd+gJI+vlho?= =?koi8-r?Q?iGGlGZ5OFD6iNXTNZRyHghgNkcJfo80U30ZaoS+YBrGP/j1PxoWaoL2VfcRux0?= =?koi8-r?Q?ZaHkDvCPuDDNLoqd9iZgSuSfexWkk3cvZzVU3pKL4v7LRVefatvkAUkfGEfg33?= =?koi8-r?Q?IB4dPfUTR0Z2pqropECNWSf3N4TX5CHGUX25GvPlA83pnmyUDHt5udmiFESpp8?= =?koi8-r?Q?XrXSI8JB2KRYDVeCXTzS6Ue+7sxRi0ZuG89DMvlZyEN7nlcM+ZJXIMmokq8EC7?= =?koi8-r?Q?NWYOmDRps3t3AVNw/66bj8qOk8V8LEl7HRH7Uy9jYUspQsb8mCnTRF70q6yto5?= =?koi8-r?Q?BBH66Zh+eijsz4/94vUTWBvIo2fehGgCrw4Hz7F56DRYX9fHmft2mWvhRmRBtm?= =?koi8-r?Q?p29SCV5ucl8dy7N2mHa8JGV/iGb7BkCXw2YAR0IV/Gda6T125q4N1j3XbJbNL+?= =?koi8-r?Q?rV3ECr8Qs5wgQH0U5KEZanKd0b3PDqqJZolmtAjjLkFNYW/WBBUpg1rkj841Is?= =?koi8-r?Q?7wPfH0IN6j2N3SUat2qIkpLqVX5GDAZ0cmBBYOEk=3D?= X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB1972;6:SW2i9vmi5Korgg23VwACWuhKkCCkjfvuGR5WPclCdXWdulLoomrAUwFgyTnJLNojXYqEaj1FlyUM89z3UfYNUKqdbvfVfsVAMJxK46xvB16ljB5nHwz/Ibwq/OURg/bjYP4WyeA8AyItWCN0WiWqWQtt8cwAJ4MnpBllHOjYI1qk6aKtHS/g770/7TaP1E0WESj8Y9/Li5qm0TdVnOUlQEtAvLNYJCGRjO6wweHbyIzlchyKycVysFdJ9YCKfLP850M8c0OBe36J2ftxLnGgJQVG39Q9iJ4VuuhUxXtjRctJPqeDPQqOU+LB8YKTt5Ey;5:Ye7tll6eCerZ61pt3uJASd/ehdxdHePMZvMUTx+JOGsq0X5v0qFzj4kziacvLkYLu/71EO7RFiJW/vy3Kq+9xs1i+bac6tXYwDMvvVCHdL8iQmHLatv1kMlA7618GkoPrTADU2DcRQXbWDLXD70b9w==;24:boQBxkiGhOpzw/C8DMD9VZ84Se9Fk+7sHDbKksFMgd0sRlpQdSbGrO7Hs/ffggUnssUrBOZQsfj3CQ9wEDBaXR9wLtez0HLPlyvQSPzYKjM=;7:MFEblVY+hR/pglDx/en3A3pewQ36+NWv6tZXqAh9r/pN3SBSTg2iqtSIfPHC1WQYR9R9rJxOIsy4gTsLjSqt2asJoa+9oWJQOmouSndGgcb+h7TSWELGmyPIhkQJVA6OAa1NaCadAyzHxAXWkXf53zq5YoOSisllReA7bkwiWEjKV1CXadSub2/V68C6+q3FRqfsGorL1VNgtaR/97pHwlvy12W9XJ1KQZ/14fNcYPFhyQY4SKl8Gsecjom8KpNA SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;AM5PR0801MB1972;20:C/GwsckKR2vqUSdT/CyfVHveAVf0CYbr4NJKLJA9heN96ZvDctd+hpDTmK4KuLCR538iy047gtpTMmHx67TgbJMNHxMGJrDKUPd0l0MF/1wrrgHiFS0VZBuWT1MFNH8Awq8Pu4u1EZUJWkFxIc6bBtZ6Y9sCDMD0u6X4ycTUoCA= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Aug 2016 22:44:24.3546 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0801MB1972 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Aug 16, 2016 at 03:05:29PM -0500, Serge E. Hallyn wrote: > Quoting Kees Cook (keescook@chromium.org): > > On Mon, Aug 15, 2016 at 1:10 PM, Andrei Vagin wrote: > > > Recently Eric added user namespace counters. User namespace counters is > > > a feature that allows to limit the number of various kernel objects a > > > user can create. These limits are set via /proc/sys/user/ sysctls on a > > > per user namespace basis and are applicable to all users in that > > > namespace. > > > > > > This patch adds /proc/PID/userns_counts files to provide current usage > > > of user namespace counters. > > > > > > > cat /proc/813/userns_counts > > > user_namespaces 101000 1 > > > pid_namespaces 101000 1 > > > ipc_namespaces 101000 4 > > > net_namespaces 101000 2 > > > mnt_namespaces 101000 5 > > > mnt_namespaces 100000 1 > > > > > > The meanings of the columns are as follows, from left to right: > > > > > > Name Object name > > > UID User ID > > > Usage Current usage > > > > > > Cc: Serge Hallyn > > > Cc: Kees Cook > > > Cc: "Eric W. Biederman" > > > Signed-off-by: Andrei Vagin > > > --- > > > fs/proc/array.c | 57 +++++++++++++++++++++++ > > > fs/proc/base.c | 3 ++ > > > fs/proc/internal.h | 1 + > > > include/linux/user_namespace.h | 8 ++++ > > > kernel/ucount.c | 102 +++++++++++++++++++++++++++++++++++++++++ > > > 5 files changed, 171 insertions(+) > > > > > > diff --git a/fs/proc/array.c b/fs/proc/array.c > > > index 88c7de1..f186625 100644 > > > --- a/fs/proc/array.c > > > +++ b/fs/proc/array.c > > > @@ -734,3 +734,60 @@ const struct file_operations proc_tid_children_operations = { > > > .release = children_seq_release, > > > }; > > > #endif /* CONFIG_PROC_CHILDREN */ > > > + > > > +#ifdef CONFIG_USER_NS > > > +static int ucounts_open(struct inode *inode, struct file *filp) > > > +{ > > > + struct ucounts_iterator *iter; > > > + struct seq_file *seq; > > > + int ret; > > > + > > > + struct task_struct *task; > > > + struct user_namespace *ns; > > > + > > > + task = get_proc_task(inode); > > > + if (!task) > > > + return -ESRCH; > > > + > > > + rcu_read_lock(); > > > + ns = get_user_ns(__task_cred(task)->user_ns); > > > + rcu_read_unlock(); > > > + > > > + put_task_struct(task); > > > + > > > + if (ns == NULL) > > > + return -ESRCH; > > > + > > > + ret = seq_open_private(filp, &ucounts_seq_operations, > > > + sizeof(struct ucounts_iterator)); > > > + > > > + if (ret) { > > > + put_user_ns(ns); > > > + return ret; > > > + } > > > + > > > + seq = filp->private_data; > > > + iter = seq->private; > > > + iter->ns = ns; > > > + > > > + return 0; > > > +} > > > + > > > +int ucounts_release(struct inode *inode, struct file *file) > > > +{ > > > + struct seq_file *seq = file->private_data; > > > + struct ucounts_iterator *iter = seq->private; > > > + > > > + put_user_ns(iter->ns); > > > + > > > + return seq_release_private(inode, file); > > > +} > > > + > > > + > > > +const struct file_operations proc_ucounts_operations = { > > > + .open = ucounts_open, > > > + .read = seq_read, > > > + .llseek = seq_lseek, > > > + .release = ucounts_release, > > > +}; > > > +#endif /* CONFIG_USER_NS */ > > > diff --git a/fs/proc/base.c b/fs/proc/base.c > > > index 54e2702..4252f7a 100644 > > > --- a/fs/proc/base.c > > > +++ b/fs/proc/base.c > > > @@ -2910,6 +2910,9 @@ static const struct pid_entry tgid_base_stuff[] = { > > > REG("timers", S_IRUGO, proc_timers_operations), > > > #endif > > > REG("timerslack_ns", S_IRUGO|S_IWUGO, proc_pid_set_timerslack_ns_operations), > > > +#ifdef CONFIG_USER_NS > > > + REG("userns_counts", S_IRUGO, proc_ucounts_operations), > > > +#endif > > > }; > > > > > > static int proc_tgid_base_readdir(struct file *file, struct dir_context *ctx) > > > diff --git a/fs/proc/internal.h b/fs/proc/internal.h > > > index 7931c55..845cadb 100644 > > > --- a/fs/proc/internal.h > > > +++ b/fs/proc/internal.h > > > @@ -298,6 +298,7 @@ extern const struct file_operations proc_pid_smaps_operations; > > > extern const struct file_operations proc_tid_smaps_operations; > > > extern const struct file_operations proc_clear_refs_operations; > > > extern const struct file_operations proc_pagemap_operations; > > > +extern const struct file_operations proc_ucounts_operations; > > > > > > extern unsigned long task_vsize(struct mm_struct *); > > > extern unsigned long task_statm(struct mm_struct *, > > > diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h > > > index 30ffe10..5f824dd 100644 > > > --- a/include/linux/user_namespace.h > > > +++ b/include/linux/user_namespace.h > > > @@ -106,6 +106,14 @@ extern ssize_t proc_setgroups_write(struct file *, const char __user *, size_t, > > > extern int proc_setgroups_show(struct seq_file *m, void *v); > > > extern bool userns_may_setgroups(const struct user_namespace *ns); > > > extern bool current_in_userns(const struct user_namespace *target_ns); > > > + > > > +struct ucounts_iterator { > > > + struct user_namespace *ns; > > > + int hash; > > > +}; > > > + > > > +extern const struct seq_operations ucounts_seq_operations; > > > + > > > #else > > > > > > static inline struct user_namespace *get_user_ns(struct user_namespace *ns) > > > diff --git a/kernel/ucount.c b/kernel/ucount.c > > > index 6ebbe9b..cef09e3 100644 > > > --- a/kernel/ucount.c > > > +++ b/kernel/ucount.c > > > @@ -9,6 +9,8 @@ > > > #include > > > #include > > > #include > > > +#include > > > +#include > > > #include > > > > > > #define UCOUNTS_HASHTABLE_BITS 10 > > > @@ -232,4 +234,104 @@ static __init int user_namespace_sysctl_init(void) > > > } > > > subsys_initcall(user_namespace_sysctl_init); > > > > > > +#ifdef CONFIG_PROC_FS > > > +static void *ucounts_start(struct seq_file *f, loff_t *pos) > > > +{ > > > + struct ucounts_iterator *iter = f->private; > > > + int h, i = 0; > > > + > > > + spin_lock(&ucounts_lock); > > > > This series is much improved, thanks! However, I still don't think > > it's a good idea to hold this spinlock across the start/stop lifetime. > > It creates too many opportunities for abuse. :( Perhaps Eric will have > > some better ideas about how to deal with this... > > Would it be too limiting to pre-allocate a page and simply fill it out > right at ucounts_start, so that we can drop the spinlock and simply > return data from that page? seq_file works like you described here. It allocates a buffer, then calls ->start(), fills the buffer and calls ->stop(). seq_file calls only ->next() and ->show() between ->start and stop(). ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos) { if (!m->buf) { m->buf = seq_buf_alloc(m->size = PAGE_SIZE); ... p = m->op->start(m, &pos); ... while (m->count < size) { ... p = m->op->next(m, p, &next); if (!p || IS_ERR(p)) { err = PTR_ERR(p); break; } err = m->op->show(m, p); if (seq_has_overflowed(m) || err) { ... break; } ... } m->op->stop(m, p); } In our case, a buffer size will not be bigger then one page, because a bigger buffer is allocated only if it isn't enough to place one record. Thanks, Andrei