From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756116AbdJPWK7 (ORCPT ); Mon, 16 Oct 2017 18:10:59 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:31824 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754256AbdJPWK5 (ORCPT ); Mon, 16 Oct 2017 18:10:57 -0400 Subject: Re: [PATCH v4] pidns: introduce syscall translate_pid To: Andrew Morton , Konstantin Khlebnikov Cc: Oleg Nesterov , linux-api@vger.kernel.org, linux-kernel@vger.kernel.org, Serge Hallyn , "Eric W. Biederman" , Eugene Syromiatnikov , prakash sangappa References: <150788678482.924140.11785205105514746135.stgit@buzz> <20171013160514.GA27812@redhat.com> <3bdb5341-9ae6-265a-ce5b-45c2cfc76fad@yandex-team.ru> <20171016143628.b2ef80a9ef16d4345889b4d9@linux-foundation.org> From: Nagarathnam Muthusamy Message-ID: Date: Mon, 16 Oct 2017 15:07:52 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: <20171016143628.b2ef80a9ef16d4345889b4d9@linux-foundation.org> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US X-Source-IP: userv0022.oracle.com [156.151.31.74] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/16/2017 02:36 PM, Andrew Morton wrote: > On Sat, 14 Oct 2017 11:17:47 +0300 Konstantin Khlebnikov wrote: > >>>>> pid_t translate_pid(pid_t pid, int source, int target); >>>>> >>>>> This syscall converts pid from source pid-ns into pid in target pid-ns. >>>>> If pid is unreachable from target pid-ns it returns zero. >>>>> >>>>> Pid-namespaces are referred file descriptors opened to proc files >>>>> /proc/[pid]/ns/pid or /proc/[pid]/ns/pid_for_children. Negative argument >>>>> refers to current pid namespace, same as file /proc/self/ns/pid. >>>>> >>>>> Kernel expose virtual pids in /proc/[pid]/status:NSpid, but backward >>>>> translation requires scanning all tasks. Also pids could be translated >>>>> by sending them through unix socket between namespaces, this method is >>>>> slow and insecure because other side is exposed inside pid namespace. >> Andrew asked why we might need this. >> >> Such conversion is required for interaction between processes across pid-namespaces. >> For example to identify process in container by pid file looking from outside. >> >> Two years ago I've solved this in project of mine with monstrous code which >> forks couple times just to convert pid, lucky for me performance wasn't important. > That's a single user who needed this a single time, and found a > userspace-based solution anyway. This is not exactly compelling! > > Is there a stronger case to be made? How does this change benefit our > users? Sell it to us! Oracle database is planning to use pid namespace for sandboxing database instances and they need an API similar to translate_pid to effectively translate process IDs from other pid namespaces. Prakash (cced in mail) can provide more details on this usecase. Thanks, Nagarathnam.