From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751413AbdAXIfX (ORCPT ); Tue, 24 Jan 2017 03:35:23 -0500 Received: from mail-he1eur01on0136.outbound.protection.outlook.com ([104.47.0.136]:15632 "EHLO EUR01-HE1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750789AbdAXIfR (ORCPT ); Tue, 24 Jan 2017 03:35:17 -0500 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=ktkhai@virtuozzo.com; Subject: Re: [PATCH 2/2] pidns: Expose task pid_ns_for_children to userspace To: Alban Crequy References: <148440326011.30622.12833059348082223242.stgit@localhost.localdomain> <148440329770.30622.16593902895676160550.stgit@localhost.localdomain> CC: Andrey Vagin , "linux-kernel@vger.kernel.org" , , "Eric W. Biederman" , Cyrill Gorcunov , Alexander Viro , Michael Kerrisk-manpages , Linux API From: Kirill Tkhai Message-ID: Date: Tue, 24 Jan 2017 11:35:08 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Icedove/45.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [195.214.232.6] X-ClientProxiedBy: VI1P194CA0009.EURP194.PROD.OUTLOOK.COM (10.175.178.19) To DB6PR0802MB2277.eurprd08.prod.outlook.com (10.172.227.150) X-MS-Office365-Filtering-Correlation-Id: 6c29fa40-ceba-4cbd-175d-08d44433eb0f X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:DB6PR0802MB2277; X-Microsoft-Exchange-Diagnostics: 1;DB6PR0802MB2277;3:XjXvFNL4YkdT7MYO8y9UaCXIqqHBAa1XYUq6y5sN1o5/vLOiCAia+gQCBHyd0H1hM7FYAvI0854v/MxUYjKr6RL0CUDkKt9RNUgY6C6/n14eLGTsnKrKT1RUHq/+7TWlVcV6Wswde6/GaW3JHHoFDhagSGIiCRnCtNeMxi4AxLu7EmASnpoAjOUYJxguiVPcouopslssU+mwpC80O35dgHZz1I6Kj/1iWXqrBmKx8AbGM0XIj4UX+zql6v5Dv9Y8MiYVtB2b4x81irhYrexWYA== X-Microsoft-Exchange-Diagnostics: 1;DB6PR0802MB2277;25:t3ADvfoTlvkCyx3DcaY3V7ZWdJI6Y7UwyUX/MtdlXMSZ1u+w/7x0tqr3oPpZurx4mdW0XKKpSZ8rYpfGriXnAJH7Hw3PYbGKmN9MnxSNKZuAyRX1gu2CSzj1yWnNOHVdE7KzWEvoFMwqA4DdIMeGGlip/VCSTnrF6xIOiE0ZnL82Zyf1VrSpObIznjNnXKLntUlzRex7Zlh5A3M8yZSYSsN5IrCSJs5OAABRO8oItHzXPjBFXXaQO82kiQPNsbmNmbO2cLzvGKNOff4aKdFk+qfnS+2rdCgPLXME468UEhsgXBY7R55gi4/WdhDJTRTVhVf5T3YWJNcp9SKxog3tn5vTzI0e4dzPV2zSX1X3BwPcbH+rYa8UTUK006QNVcr79Ki3bmn3wnH8J3nXzbsFMeUNpUxSnxlZRgIy5SIM3fX+fD382dVStfrNFjc2BUy7nKzpbJba7l8KGB4u4T2QVGsX8V8HY/vz/olEjMVldWVd8+EmQ9xje1JAUv9tEf+QQjeX6+utSn2BI5jpYsoVk0CzFWFbtuJN55e6NF5pL+fWx/9rYchsi3XYsVbIVigaekwgzBJ3pZiJHLfHUzaV05VMfU2/kj0mjjgonbr2HjsUHBVvcAHbDzNnjCgflNN4v0OI+ml4ZrKbRVAfa4+NWNrrvV3IQ6+GNQU44Xk5Pf5VQy8vc4hjGmHzoIEH6SCbLqLnAuEKuaCpAGuS2eqczl3CXWquqwdCgRxbf3NQYmJcApvoV0Xda4/Ac96zqs7Y X-Microsoft-Exchange-Diagnostics: 1;DB6PR0802MB2277;31:/1l6N1Zpyjo3N3jPjZZcdx4CD1W2VQl9L0BjizvbR3CN3kXj9PXWH1PmDxSfM0GCAduuktFVXpuiG0J3IotKNXABNJ5U9ECEmkYRV7+mvHVuYi8tEIAis3orLIltSdKYkg/IsA0bZd9w0s/OoLxPWcZV3Xce7Z1QpUCJ0kdjIKCLhH4xHRuMc7T8URv7OCmGhyA2dcfh8ZCZ5MO+7+Tq6qsfTk0u0fIhAzZ2Mh3EV9H5MfBBsk06FNjnvr//2TvdVMwn+iUw9uX/8iBsuUzFjg==;20:G4ksh8RaIS46DCRJxsnHIXl3eDtnEQO+U8aqeSeoX6gO4sODPyKFYq/VrGWgKaKWmSxs2z7UcmVo8X1aapyZ+SUPUu4SQhmuDGxeaUDTiKO8f8jMUGJqA3K9Ss9xVGVmrDYpMtbyTwm6ebDGEp/gYFvSuQllQN5GWKnlmV2q1HcXt6kSWg1fYg8+61OHYYxTWHsMV7VmjfRboJnXw2hJY85Z7dUiz5mEHqosTsECezxBMrWIhLefv++CnFqfDQIN X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6041248)(20161123564025)(20161123560025)(20161123562025)(20161123555025)(6072148);SRVR:DB6PR0802MB2277;BCL:0;PCL:0;RULEID:;SRVR:DB6PR0802MB2277; X-Microsoft-Exchange-Diagnostics: 1;DB6PR0802MB2277;4:ipeTgoB5Hcdsx/MyttELUc7KPSXT7+7bLXCczVtzrQgGW7vScCZGHvpqr5e1tgKhiOouw3iNIu0NIXqlRNOtF/D5d04FiStfuGusSNd0T9DWv39cYvG8BMQ/dZHriu+dgjYY5zodahZkCakDlQtbIs84izec/nOVTcdr/qvxlnxOfGdzvbwT05G7S66YWc3DEE8Cc1pwqCOWDQqmODayf3HwltRFZvSfcv54xURLvFLcLMf4Jnwl4R2uqZU3YYAsKxZL1qo6pA/8qfu296RdElcPIHafO9iUl5sKWnZ2ezq0L/Njxz1qZlWeuPyetHfiTrTMZfe9EME8Kvpr9No2RGa6qGgg0bKcVEj3Xu9l5Ojl9Of2hS7ZArxd8AJVX6pSNCdEc1IW4TqpwegIGqospGyk+r8BMmViA9gCXxQFvIWQe+w0YYQObVjwl+rcQOqTxGqWZEmTw7rb2I5HqjN8G5mAFEt5VKJZYz8BPS9zsJ+rxEDLCYNI6J+1xjJgWQKV8oOrHTAaWEMNg9ayfRO5IifLaxZo1+5twOz8b1NOEQIjuPG4AdkfhpcQoaw1UyWRajlNPg1gD89S9LAIu1oPZg== X-Forefront-PRVS: 0197AFBD92 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6009001)(6049001)(7916002)(39830400002)(39410400002)(39450400003)(189002)(24454002)(199003)(106356001)(105586002)(97736004)(4001350100001)(3846002)(4326007)(50466002)(101416001)(64126003)(31696002)(86362001)(42186005)(2906002)(31686004)(6116002)(23676002)(53936002)(92566002)(33646002)(189998001)(38730400001)(47776003)(66066001)(50986999)(54356999)(81156014)(81166006)(110136003)(2950100002)(6916009)(76176999)(7736002)(90366009)(25786008)(5660300001)(39060400001)(8676002)(77096006)(305945005)(36756003)(68736007)(6486002)(54906002)(229853002)(230700001)(83506001)(6666003);DIR:OUT;SFP:1102;SCL:1;SRVR:DB6PR0802MB2277;H:[172.16.25.185];FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtEQjZQUjA4MDJNQjIyNzc7MjM6YTJYdkc1SUtzcXl6Z25idm9FWmVtYVRO?= =?utf-8?B?ZWZuR2llZFZ3QVRlcS9vZkRaS3JpK2RrVXZZQy9kbDFqdGZLQUFJazM0L0Y0?= =?utf-8?B?eW9tSnAvZmUrTHpRTmhNZlJWbDdMMTkrVndkU1ovKzdqTDluWDlGVFNyNDlR?= =?utf-8?B?WkhNUlNVVGZlNUh4eXd3dnF4ZnlnNkkwVm5MWjlsSHZIRVFSWlduWUQ3b0Jx?= =?utf-8?B?R0FTemZSL0JUTllWeXhlWFVHRnpLMWdrRjQ1S2Z1b2RhOFFibU5mc09NSjkr?= =?utf-8?B?eXhtaC9oVDVLbzVZWWNZTmV3YnpvNHB1VXgxQ1JYajBXTWlmQUN6TktCSHIv?= =?utf-8?B?MGhqVklSeElXTHVGYkwwLytKRlVzUlprMGM4OVZlUHNPODFCN2NYWExDWktC?= =?utf-8?B?MUFwWnhoYTRucDV5UGVDemVhdm5Hb29PWjZhN0RDZWFrS3RQdVBUdWVFbkJr?= =?utf-8?B?ZHJDVWpvTmtMazk0LzBTTDl4QkRGMlpVMkM2TW9TVTVaTHlJKzB4c3VYTUVx?= =?utf-8?B?SU5xWEVwTk96cUtPY25FMDJUL1ZUMzRneENQZjZvM0RQU1NwTE1jSkNoQkZX?= =?utf-8?B?cVVVTktuTFhGa1JXamdHTFNDSlovQnN6RkdkWmFrNzV1eFNLTFpxK1N5MDUy?= =?utf-8?B?eFdkQTNTRkpETVR0Rjg3R3UzZjRQSDlIN3RScVpWTU1oZEV0elJsa0ZZR0Iw?= =?utf-8?B?SVZnRXlPL3NxS2VqZUF1ZGt0akp5T3FQQmpRa3dlenord2I1UXBqUjZxWlZy?= =?utf-8?B?c01RTnpaT0piQWN1VlhVNGswKy9rTDgvMGRKcDNaZFZQZnpxQmFJUDZsOVFS?= =?utf-8?B?eUtKU0xJaGw1ZzJyVFhYdEl4OXl6VXVlVHlZMTBHV0plTDBzRFc5REx6Qm40?= =?utf-8?B?bE9KaDRGVGM3YWpjSlFaZmRrZThvMUVkcnh4eUxtcy9XNXB4azkvRWpEK3l2?= =?utf-8?B?aWQ5S1d0S0N4VzJFTCtrdTR0V09BSE96anFSTVFlQUhEYTg3STVrMk9BbkNH?= =?utf-8?B?TTVDWU1wUE40RHJBMjdHV2pRR3lFZHNGZnA2NkRSK3I3MjU0UkphVEhKck8r?= =?utf-8?B?Z3g5N0JQRFRWd0prQmRsVGp2NklpcU8wMDg1L3RTeVZKdVl6VWJVejNYc0k2?= =?utf-8?B?dzM0Qlh4RWdtYUpidlZaUnNkYjdwMkVtaGhsZTFWcmQ5NUJ3YVdRMHNKL0cx?= =?utf-8?B?KzRMdWR4RHZLSEh4STFIL2NWUFNPRkhQemIzbEp1UTlTZ2hjcTNJS2VlLy9K?= =?utf-8?B?bm10VTAzVVBSZFRBck1DQzdpK09NKzlES3F1aFI5RmZ6WW9xNXNkdE1zMHhR?= =?utf-8?B?M3poaVZaY2tyRit6OW5JYmdwWjNtVHQrK3V2UWF6dWczUVpSTVFyMzZJdTJq?= =?utf-8?B?cW9NRUR3eWI1YmlGc25VanRCRlBBZUF0VUJxazlxeXlubGU4Mkp0N2xsUGc4?= =?utf-8?B?NzBBc2VyZHNReXQyTTVxdVJhTlhXRmRzTjBCcjRlZWF6ejRtQTJNQmNZMTBu?= =?utf-8?B?S0ZkTEhJM1poZlllblFWK3doRGtRQ1hhemtKOVRZUDEwd21VdlJWemRXR0VF?= =?utf-8?B?TTE1Nm9PcVRVem1YUVJsNE90QkJramo0d3p4ZWx4SFp2SFhHZE05QWVFOGh0?= =?utf-8?B?a01udnp0SVk3bDBtL0krMm9PdVZSR2VabEE4NkhpTHB3NUxhdVNjR1BwR0hN?= =?utf-8?B?Z0lxcUJ0eGRTVGZBVGRXL1dDajNLRnhMRmtoZ2VSK3VNYnZsajFOTldOeTIx?= =?utf-8?B?eWl2OW9UNWUvZVJKUUFpRW1DeWE3TDE0YnhNWnN3OThhbjcwS083UGVkOXls?= =?utf-8?B?N0ZSRTcxWmQrbTdmRXpwNjlsL05tSkFOdWdVcWRtY09mQXIvZktwZ3k0MW9L?= =?utf-8?Q?HgdD83KD7YR7E=3D?= X-Microsoft-Exchange-Diagnostics: 1;DB6PR0802MB2277;6:j70mnqhUi+fgJUkNXREk00Ogy6tjx4ZrpJtTLa82n0iXEs2+FyvZLDPsBzHT89w2MN2lr/cf8YQHhVxz6fmlXwwGm0SnD7IcJXJMZVievvGm/Krn6cTmC5HdPGTev0ewa04qR4dMo3UK/Uv3IKBcW+900Sv9+vAWFUSmaeuw6GKtkY4uEYbo8z7j/6LZHOLihxgsT1nII1CCCBLvu1BLu62Lx7JQR2kl/sZbDRdOklvn77flmDIz/rFyhrtSVYtCm1KyGyabknF1W6f6TruxpcV5EuTTCUoFkzdZt6sDXuhGEICDQmjOsR5sSW5xuz7kq4sehIy7p01TbIIRferQKSDlpDyPM3asOUEOj33cwJw9rqqamlsGGO5foDd8YXI1/ayuek07W0GbPGJEUV37iyLAorNpxbz7XZivcbncGDA=;5:kiw5NU/V57iCWs4UEBSPkhf7L8J1rQmlBOXu5MMoS9ckjAe82YKuNau4WkuQAppNV7j3cZQjrFLQEToXLy+vdGqm+Wd6Hw7A8a9BZ5A/SLDJzULNmAIR42O6lY3zQPOnyEKHu+uTrCVD10ggqD2jRA==;24:B10LTE5NQVR4tYldp2KuArxOwjlYPM4aTk67r+NAIwV0DG7lLeu31/zo8Zecwzl3LcQOKlRgYGNE15qwfVUMgQMZc8db29Hn7wQJR7ZRu8o= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;DB6PR0802MB2277;7:sL0w6ZflTMW+VmbALk4HsShOgKQOPVoN6cj+wGxUwhazDNcmYj1qJTxAYW9S88QMVFy2bhQzLXTBusGw8QvxowMpf9W12R8zvYLZJlWeu5/T/EDm8JCwxHwBuyAYu6r4jEhtHVm7m2GIINSRS4r1ftShEseYnkZFCbcrS0oZ/GhdDHGnLBSbW147XwyCJTzjXIQz6mruAnMi00/9DEvgEH+VHyG3nWcG57bJq+u35NqDIyHsGE0VpENbkj1t8yipiGaimFdID0+Tscm9wED/PbvXRSTNltzhHMts1Zoze1PgqCgweqpbik3pQ6+dawY9Qyk5L+teHZdGjIk1sINLuN7NuZCUkEhQd9LUO2JQtC+ksH8eI9WboyvLBxlIX6HMPLkWSr5T1X0o+ED6MKLWQ+aeBFBz/hqyR7BvYC+DTPOpfNWi148E9GOW8Lc7UNGDMDFD9alWUS/5FTrDcynILg==;20:gT24T/H0cwsbeZ3kGQqT7nn2/lIF8YUHukfOLdfZn3QK4+jj6VJi4xlNafood3AInET2jfr8GbaTgkHXc9gj9OEMXyOwdFRcG7qN1kBh34lGKamOsEX9MTVSDIgRXnq3MnlShiweKvo/KSidfDV/ZFGTaTP7ExN+CiammHGrSlk= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Jan 2017 08:35:13.2428 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0802MB2277 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 24.01.2017 00:49, Alban Crequy wrote: > On 14 January 2017 at 15:15, Kirill Tkhai wrote: >> For correct checkpointing/restoring of a task from userspace >> it's need to know the task's pid_ns_for_children. Currently, >> there is no a sane way to do that (the only possible trick >> is to force the task create a new child and to analize the >> child's /proc/[pid]/ns/pid link, that is performance-stupid). >> >> The patch exposes pid_ns_for_children to ns directory >> in standard way with the name "pid_for_children": >> >> ~# ls /proc/5531/ns -l | grep pid >> lrwxrwxrwx 1 root root 0 Jan 14 16:38 pid -> pid:[4026531836] >> lrwxrwxrwx 1 root root 0 Jan 14 16:38 pid_for_children -> pid:[4026532286] >> >> Signed-off-by: Kirill Tkhai > > What's happening if a process, after unsharing CLONE_NEWPID, does not > fork but instead let another process open the new "pid_for_children" > and then setns()+fork()? Is that other process allowed to create the > "pid 1" in the new pid namespaces? Is that also allowed if the other > process lives in a sibling pid namespace? If so, that would break what > pid_namespaces(7) says: > > "the parental relationship between processes mirrors the parental > relationship between PID namespaces: the parent of a process is > either in the same namespace or resides in the immediate parent > PID namespace." > You can setns() on a pid_ns only if your active pid_ns is a (grand)parent for the target pid_ns. So, the situation you described is not possible. See pidns_install() for the details.