Re: [PATCH RFC v5] pidns: introduce syscall translate_pid
From: Eric W. Biederman <hidden>
Date: 2018-05-31 18:03:01
Also in:
lkml
"Michael Kerrisk (man-pages)" [off-list ref] writes:
On 04/05/2018 09:02 AM, Konstantin Khlebnikov wrote:quoted
On 05.04.2018 01:29, Eric W. Biederman wrote:quoted
Nagarathnam Muthusamy [off-list ref] writes:quoted
On 04/04/2018 12:11 PM, Konstantin Khlebnikov wrote:quoted
Each process have different pids, one for each pid namespace it belongs. When interaction happens within single pid-ns translation isn't required. More complicated scenarios needs special handling. For example: - reading pid-files or logs written inside container with pid namespace - attaching with ptrace to tasks from different pid namespace - passing pids across pid namespaces in any kind of API Currently there are several interfaces that could be used here: Pid namespaces are identified by inode number of /proc/[pid]/ns/pid.Using the inode number in interfaces is not an option. Especially not withou referencing the device number for the filesystem as well.This is supposed to be single-instance fs, not part of proc but referenced but its magic "symlinks". Device numbers are not mentioned in "man namespaces".Thanks for the heads-up! That was a bug in the man-page. ioctl_ns(2) already says the right thing. Now I patches namespaces(7), as below.
Acked-by: "Eric W. Biederman" <redacted> For the changes to namespaces.7. I suspect you have already applied them by now, but if not. Eric
quoted hunk
Cheers, Michaeldiff --git a/man7/namespaces.7 b/man7/namespaces.7 index 725ebaff6..3c155de7e 100644 --- a/man7/namespaces.7 +++ b/man7/namespaces.7@@ -154,11 +154,14 @@ In Linux 3.7 and earlier, these files were visible as hard links. Since Linux 3.8, .\" commit bf056bfa80596a5d14b26b17276a56a0dcb080e5 they appear as symbolic links. -If two processes are in the same namespace, then the inode numbers of their +If two processes are in the same namespace, +then the device IDs and inode numbers of their .IR /proc/[pid]/ns/xxx symbolic links will be the same; an application can check this using the +.I stat.st_dev +and .I stat.st_ino -field returned by +fields returned by .BR stat (2). The content of this symbolic link is a string containing the namespace type and inode number as in the following example: