Re: [GIT PULL] namespaces related fixes for v4.11-rc1

Aleksa Sarai [off-list ref] writes:

quoted

The only known user of this prctl systemd
forks all children after the prctl.  So no userspace regressions will
occur.

Note that runC and containerd (and thus Docker) as well as cri-o use the prctl
as well -- to be able to collect exit codes from a non-child process (namely to
collect the exit code from PID 1 in the container).

Are any of those affected by the change?  I would not expect so.  As it
would require having children or grand children whose exit codes you
don't want to collect.

Eric

quoted

quoted

The only known user of this prctl systemd
forks all children after the prctl.  So no userspace regressions will
occur.

Note that runC and containerd (and thus Docker) as well as cri-o use the prctl
as well -- to be able to collect exit codes from a non-child process (namely to
collect the exit code from PID 1 in the container).

Are any of those affected by the change?  I would not expect so.  As it
would require having children or grand children whose exit codes you
don't want to collect.

AFAICS they do appear to work (and runC definitely calls the prctl before it creates the container init process -- so it shouldn't break anything for runC). I was just pointing out that systemd isn't the only major userspace user of the prctl (for future reference).

-- 
Aleksa Sarai
Software Engineer (Containers)
SUSE Linux GmbH
https://www.cyphar.com/

On Wed, Feb 22, 2017 at 5:29 PM, Eric W. Biederman
[off-list ref] wrote:

Aleksa Sarai [off-list ref] writes:

quoted

quoted

The only known user of this prctl systemd
forks all children after the prctl.  So no userspace regressions will
occur.

Note that runC and containerd (and thus Docker) as well as cri-o use the prctl
as well -- to be able to collect exit codes from a non-child process (namely to
collect the exit code from PID 1 in the container).

Are any of those affected by the change?  I would not expect so.  As it
would require having children or grand children whose exit codes you
don't want to collect.

FWIW, I have private code that uses PR_SET_CHILD_SUBREAPER, too.  I
don't see why it would be affected by this change.