Re: [PATCH V3 0/6] namespaces: log namespaces per task

On 14/05/26, Michael Kerrisk (man-pages) wrote:

Hi Richard

On Mon, May 26, 2014 at 6:58 PM, Richard Guy Briggs [off-list ref] wrote:

quoted

On 14/05/22, Michael Kerrisk wrote:

quoted

Richard,

Hi Michael,

quoted

On Tue, May 20, 2014 at 3:12 PM, Richard Guy Briggs [off-list ref] wrote:

quoted

The purpose is to track namespaces in use by logged processes from the
perspective of init_*_ns.

1/6 defines a function to generate them and assigns them.

Use a serial number per namespace (unique across one boot of one kernel)
instead of the inode number (which is claimed to have had the right to change
reserved and is not necessarily unique if there is more than one proc fs).  It
could be argued that the inode numbers have now become a defacto interface and
can't change now, but I'm proposing this approach to see if this helps address
some of the objections to the earlier patchset.

2/6 adds access functions to get to the serial numbers in a similar way to
inode access for namespace proc operations.

3/6 implements, as suggested by Serge Hallyn, making these serial numbers
available in /proc/self/ns/{ipc,mnt,net,pid,user,uts}_snum.  I chose "snum"
instead of "seq" for consistency with inum and there are a number of other uses
of "seq" in the namespace code.

4/6 exposes proc's ns entries structure which lists a number of useful
operations per namespace type for other subsystems to use.

Since the 3 and 4 change the ABI, please CC iterations of this patch
series to linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, as per Documentation/SubmitChecklist.

Neither patch 3/6 nor 4/6 changes the syscall interface.

(Agreed.)

quoted

Patch 3/6 adds /proc/<pid>/ns/ entries, which looks more like #16 in
that document (for which /proc/<pid>/ns/<nstype> was never added).

But, that's a change to the surface that the kernel exposes to user
space, right? If so, it is best CCed to linux-api.

Got it.  Thanks!

Thanks,

Michael

- RGB

--
Richard Guy Briggs [off-list ref]
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545