Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1362164

Re: [PATCH v2 3/3] Make core_pattern support namespace

Show all headers | View raw

Zhao Lei <zhaolei@cn.fujitsu.com> writes:

> Hi, Eric
>
>> -----Original Message-----
>> From: Eric W. Biederman [mailto:ebiederm@xmission.com]

> Let me make a summarize:
> You think this way is not acceptable, because the pipe program is running
> in the panic-process's namespace context.

Actually my view is that your patchset is not acceptable because it
is implemented in a way that is not backwards compatible (AKA it can
break existing configurations that remain unchanged) and your
implementation does not appear in the least safe from malicious users.

There is also a problem that your patchset is simply buggy for what it
tries to implement, as using pid_ns_for_children and the multiple kbuild
robot emails testifies.

> And in my view, a pipe program in the host's top level namespace is also
> a problem.
>
> Let us think a container, to make it act as a real machine, when a program
> panic, linux kernel should dump it into the container's filesystem.
>
> For the kernel, to keep the current way of forking pipe program by kthread,
> just let the pipe thread running in the container's namespace, instead the host,
> may solve the problem in current kernel.
>
> What is your opinion?
>
> Btw, this patch is trying to solve the problem descripted in thread named:
> "piping core dump to a program escapes container" in
> http://lists.linuxfoundation.org/pipermail/containers/2015-December/036476.html
> Maybe using a userspace tool can make container dump to anywhere,
> but for kernel ifself, it is better to solve above problem if we can.

I think it would be great to find a way to run a core dump helper and
otherwise allow setting the core dump pattern in a container in a way
that is safe from malicious users and does not break existing setups.

Eric

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v2 0/3] Make core_pattern support namespace Zhao Lei <zhaolei@cn.fujitsu.com> - 2016-03-18 14:00 +0100
  [PATCH v2 3/3] Make core_pattern support namespace Zhao Lei <zhaolei@cn.fujitsu.com> - 2016-03-18 14:00 +0100
    Re: [PATCH v2 3/3] Make core_pattern support namespace ebiederm@xmission.com (Eric W. Biederman) - 2016-03-21 07:20 +0100
      RE: [PATCH v2 3/3] Make core_pattern support namespace Zhao Lei <zhaolei@cn.fujitsu.com> - 2016-03-21 08:20 +0100
        Re: [PATCH v2 3/3] Make core_pattern support namespace ebiederm@xmission.com (Eric W. Biederman) - 2016-03-21 09:30 +0100
          RE: [PATCH v2 3/3] Make core_pattern support namespace Zhao Lei <zhaolei@cn.fujitsu.com> - 2016-03-21 11:10 +0100
            Re: [PATCH v2 3/3] Make core_pattern support namespace ebiederm@xmission.com (Eric W. Biederman) - 2016-03-21 22:40 +0100
              RE: [PATCH v2 3/3] Make core_pattern support namespace Zhao Lei <zhaolei@cn.fujitsu.com> - 2016-03-22 02:40 +0100
                Re: [PATCH v2 3/3] Make core_pattern support namespace ebiederm@xmission.com (Eric W. Biederman) - 2016-03-23 00:00 +0100
                RE: [PATCH v2 3/3] Make core_pattern support namespace Zhao Lei <zhaolei@cn.fujitsu.com> - 2016-03-23 13:00 +0100
                Re: [PATCH v2 3/3] Make core_pattern support namespace ebiederm@xmission.com (Eric W. Biederman) - 2016-03-23 21:10 +0100
  [PATCH v2 2/3] Run dump pipe in container's namespace Zhao Lei <zhaolei@cn.fujitsu.com> - 2016-03-18 14:00 +0100
    Re: [PATCH v2 2/3] Run dump pipe in container's namespace kbuild test robot <lkp@intel.com> - 2016-03-18 15:10 +0100
  [PATCH v2 1/3] Make _do_fork support return to caller's code Zhao Lei <zhaolei@cn.fujitsu.com> - 2016-03-18 14:00 +0100

csiph-web