From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751552AbcAEIIK (ORCPT ); Tue, 5 Jan 2016 03:08:10 -0500 Received: from out01.mta.xmission.com ([166.70.13.231]:46901 "EHLO out01.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750972AbcAEIIG (ORCPT ); Tue, 5 Jan 2016 03:08:06 -0500 From: ebiederm@xmission.com (Eric W. Biederman) To: Dongsheng Yang Cc: Al Viro , , LKML , , Kamezawa Hiroyuki In-Reply-To: <568B629E.5010806@cn.fujitsu.com> (Dongsheng Yang's message of "Tue, 5 Jan 2016 14:28:46 +0800") References: <56729B3D.1040502@cn.fujitsu.com> <56760F05.3020308@cn.fujitsu.com> <20151220023712.GT20997@ZenIV.linux.org.uk> <567616D6.6060202@cn.fujitsu.com> <87fuyx1mfn.fsf@x220.int.ebiederm.org> <567798EC.1040304@cn.fujitsu.com> <87twnbzcz8.fsf@x220.int.ebiederm.org> <567A1120.3070204@cn.fujitsu.com> <8760zpxgte.fsf@x220.int.ebiederm.org> <568B629E.5010806@cn.fujitsu.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) Date: Tue, 05 Jan 2016 01:58:34 -0600 Message-ID: <87k2nopidx.fsf@x220.int.ebiederm.org> MIME-Version: 1.0 Content-Type: text/plain X-XM-AID: U2FsdGVkX18DK30/uuj7ZjHkzsEHxhYUA23R0iHG8Mk= X-SA-Exim-Connect-IP: 97.121.81.63 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 0.0 TVD_RCVD_IP Message was received from an IP address * 0.0 T_TM2_M_HEADER_IN_MSG BODY: No description available. * 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% * [score: 0.4372] * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa05 1397; Body=1 Fuz1=1 Fuz2=1] * 0.0 T_TooManySym_01 4+ unique symbols in subject X-Spam-DCC: XMission; sa05 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: ;Dongsheng Yang X-Spam-Relay-Country: X-Spam-Timing: total 799 ms - load_scoreonly_sql: 0.07 (0.0%), signal_user_changed: 5.0 (0.6%), b_tie_ro: 3.5 (0.4%), parse: 1.33 (0.2%), extract_message_metadata: 18 (2.3%), get_uri_detail_list: 2.2 (0.3%), tests_pri_-1000: 4.4 (0.6%), tests_pri_-950: 1.20 (0.2%), tests_pri_-900: 0.98 (0.1%), tests_pri_-400: 18 (2.3%), check_bayes: 17 (2.2%), b_tokenize: 4.7 (0.6%), b_tok_get_all: 6 (0.7%), b_comp_prob: 1.78 (0.2%), b_tok_touch_all: 2.9 (0.4%), b_finish: 0.71 (0.1%), tests_pri_0: 496 (62.1%), check_dkim_signature: 0.53 (0.1%), check_dkim_adsp: 23 (2.9%), tests_pri_500: 249 (31.2%), poll_dns_idle: 240 (30.1%), rewrite_mail: 0.00 (0.0%) Subject: Re: [Propose] Isolate core_pattern in mnt namespace. X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Wed, 24 Sep 2014 11:00:52 -0600) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Dongsheng Yang writes: > On 12/24/2015 12:36 AM, Eric W. Biederman wrote: >> Dongsheng Yang writes: > [...] > > Hi Eric, > Happy new year and sorry for the late reply. >> >> Given the other constraints on an implementation the pid namespace looks >> by far the one best suited to host such a sysctl if it is possible to >> implement safely. > > So you think it's better to isolate the core_pattern in pid_namespace, > am I right? Roughly. > But, core_file_path and user_mode_helper_path in core_pattern are much > more related with mnt_namespace IMO. > > Could you help to explain it more? You need a full complement of namespaces, to execute a user mode helper. Really roughly you need a namespaced equivalent of kthreadd, with a full complement of namespaces and cgroups setup in the container. Further it is necessary to have a clear rule that says which processes that dump core are affected. For a hierarchical pid namespace this is straight forward. For a mount namespace I don't know how that could be implemented. And yes the whole kthreadd thing that user mode helper does to launch a task is necessary to have a clean and predicatable environment. Of course the default rule of dropping a file named core in the current directory of the process that died works for everyone, with no kernel modifications needed. Eric