Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1286082 > unrolled thread

CGroup Namespaces (v6)

Started byserge.hallyn@ubuntu.com
First post2015-12-08 00:10 +0100
Last post2015-12-08 16:30 +0100
Articles 2 on this page of 22 — 5 participants

Back to article view | Back to linux.kernel


Contents

  CGroup Namespaces (v6) serge.hallyn@ubuntu.com - 2015-12-08 00:10 +0100
    [PATCH 1/7] kernfs: Add API to generate relative kernfs path serge.hallyn@ubuntu.com - 2015-12-08 00:10 +0100
      Re: [PATCH 1/7] kernfs: Add API to generate relative kernfs path Tejun Heo <tj@kernel.org> - 2015-12-08 17:00 +0100
        Re: [PATCH 1/7] kernfs: Add API to generate relative kernfs path "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-12-08 17:50 +0100
        Re: [PATCH 1/7] kernfs: Add API to generate relative kernfs path "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-12-08 19:50 +0100
      Re: [PATCH 1/7] kernfs: Add API to generate relative kernfs path Greg KH <gregkh@linuxfoundation.org> - 2015-12-09 01:50 +0100
        Re: [PATCH 1/7] kernfs: Add API to generate relative kernfs path "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-12-09 02:20 +0100
    [PATCH 2/7] sched: new clone flag CLONE_NEWCGROUP for cgroup namespace serge.hallyn@ubuntu.com - 2015-12-08 00:10 +0100
    [PATCH 3/7] cgroup: introduce cgroup namespaces serge.hallyn@ubuntu.com - 2015-12-08 00:10 +0100
      Re: [PATCH 3/7] cgroup: introduce cgroup namespaces Tejun Heo <tj@kernel.org> - 2015-12-08 17:10 +0100
        Re: [PATCH 3/7] cgroup: introduce cgroup namespaces "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-12-08 20:40 +0100
          Re: [PATCH 3/7] cgroup: introduce cgroup namespaces "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-12-08 20:50 +0100
          Re: [PATCH 3/7] cgroup: introduce cgroup namespaces Tejun Heo <tj@kernel.org> - 2015-12-08 20:50 +0100
    [PATCH 6/7] cgroup: Add documentation for cgroup namespaces serge.hallyn@ubuntu.com - 2015-12-08 00:10 +0100
      Re: [PATCH 6/7] cgroup: Add documentation for cgroup namespaces Tejun Heo <tj@kernel.org> - 2015-12-08 17:30 +0100
    [PATCH 5/7] cgroup: mount cgroupns-root when inside non-init cgroupns serge.hallyn@ubuntu.com - 2015-12-08 00:10 +0100
      Re: [PATCH 5/7] cgroup: mount cgroupns-root when inside non-init  cgroupns Tejun Heo <tj@kernel.org> - 2015-12-08 17:30 +0100
        Re: [PATCH 5/7] cgroup: mount cgroupns-root when inside non-init  cgroupns "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-12-08 17:50 +0100
        Re: [PATCH 5/7] cgroup: mount cgroupns-root when inside non-init  cgroupns "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-12-09 00:30 +0100
          Re: [PATCH 5/7] cgroup: mount cgroupns-root when inside non-init  cgroupns Tejun Heo <tj@kernel.org> - 2015-12-09 16:50 +0100
    Re: CGroup Namespaces (v6) Alban Crequy <alban.crequy@gmail.com> - 2015-12-08 11:20 +0100
      Re: CGroup Namespaces (v6) "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-12-08 16:30 +0100

Page 2 of 2 — ← Prev page 1 [2]


#1286376

FromAlban Crequy <alban.crequy@gmail.com>
Date2015-12-08 11:20 +0100
Message-ID<qDnxh-Xg-13@gated-at.bofh.it>
In reply to#1286082
Hi,

Thanks for the patches!

On 8 December 2015 at 00:06,  <serge.hallyn@ubuntu.com> wrote:
> Hi,
>
> following is a revised set of the CGroup Namespace patchset which Aditya
> Kali has previously sent.  The code can also be found in the cgroupns.v6
> branch of
>
> https://git.kernel.org/cgit/linux/kernel/git/sergeh/linux-security.git/
>
> To summarize the semantics:
>
> 1. CLONE_NEWCGROUP re-uses 0x02000000, which was previously CLONE_STOPPED
>
> 2. unsharing a cgroup namespace makes all your current cgroups your new
> cgroup root.
>
> 3. /proc/pid/cgroup always shows cgroup paths relative to the reader's
> cgroup namespce root.  A task outside of  your cgroup looks like
>
>         8:memory:/../../..
>
> 4. when a task mounts a cgroupfs, the cgroup which shows up as root depends
> on the mounting task's  cgroup namespace.
>
> 5. setns to a cgroup namespace switches your cgroup namespace but not
> your cgroups.
>
> With this, using github.com/hallyn/lxc #2015-11-09/cgns (and
> github.com/hallyn/lxcfs #2015-11-10/cgns) we can start a container in a full
> proper cgroup namespace, avoiding either cgmanager or lxcfs cgroup bind mounts.

I tested cgroupns.v6 with systemd-nspawn + patches from
https://github.com/systemd/systemd/pull/2112 using
unshare(CLONE_NEWCGROUP) booted with
systemd.unified_cgroup_hierarchy=1 in Fedora22. Tested with and
without userns. It worked for me :)

Do you need people to run more tests, with other scenarios?

Do you have patches already for /usr/bin/unshare and /usr/bin/nsenter?

> This is completely backward compatible and will be completely invisible
> to any existing cgroup users (except for those running inside a cgroup
> namespace and looking at /proc/pid/cgroup of tasks outside their
> namespace.)
>
> Changes from V5:
> 1. To get a root dentry for cgroup namespace mount, walk the path from the
>    kernfs root dentry.
>
> Changes from V4:
> 1. Move the FS_USERNS_MOUNT flag to last patch
> 2. Rebase onto cgroup/for-4.5
> 3. Don't non-init user namespaces to bind new subsystems when mounting.
> 4. Address feedback from Tejun (thanks).  Specificaly, not addressed:
>    . kernfs_obtain_root - walking dentry from kernfs root.
>      (I think that's the only piece)
> 5. Dropped unused get_task_cgroup fn/patch.
> 6. Reworked kernfs_path_from_node_locked() to try to simplify the logic.
>    It now finds a common ancestor, walks from the source to it, then back
>    up to the target.
>
> Changes from V3:
> 1. Rebased onto latest cgroup changes.  In particular switch to
>    css_set_lock and ns_common.
> 2. Support all hierarchies.
>
> Changes from V2:
> 1. Added documentation in Documentation/cgroups/namespace.txt
> 2. Fixed a bug that caused crash
> 3. Incorporated some other suggestions from last patchset:
>    - removed use of threadgroup_lock() while creating new cgroupns
>    - use task_lock() instead of rcu_read_lock() while accessing
>      task->nsproxy
>    - optimized setns() to own cgroupns
>    - simplified code around sane-behavior mount option parsing
> 4. Restored ACKs from Serge Hallyn from v1 on few patches that have
>    not changed since then.
>
> Changes from V1:
> 1. No pinning of processes within cgroupns. Tasks can be freely moved
>    across cgroups even outside of their cgroupns-root. Usual DAC/MAC policies
>    apply as before.
> 2. Path in /proc/<pid>/cgroup is now always shown and is relative to
>    cgroupns-root. So path can contain '/..' strings depending on cgroupns-root
>    of the reader and cgroup of <pid>.
> 3. setns() does not require the process to first move under target
>    cgroupns-root.
>
> Changes form RFC (V0):
> 1. setns support for cgroupns
> 2. 'mount -t cgroup cgroup <mntpt>' from inside a cgroupns now
>    mounts the cgroup hierarcy with cgroupns-root as the filesystem root.
> 3. writes to cgroup files outside of cgroupns-root are not allowed
> 4. visibility of /proc/<pid>/cgroup is further restricted by not showing
>    anything if the <pid> is in a sibling cgroupns and its cgroup falls outside
>    your cgroupns-root.
>
>
> _______________________________________________
> Containers mailing list
> Containers@lists.linux-foundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/containers
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1286585

From"Serge E. Hallyn" <serge.hallyn@ubuntu.com>
Date2015-12-08 16:30 +0100
Message-ID<qDsng-44U-17@gated-at.bofh.it>
In reply to#1286376
On Tue, Dec 08, 2015 at 11:10:03AM +0100, Alban Crequy wrote:
> Hi,
> 
> Thanks for the patches!
> 
> On 8 December 2015 at 00:06,  <serge.hallyn@ubuntu.com> wrote:
> > Hi,
> >
> > following is a revised set of the CGroup Namespace patchset which Aditya
> > Kali has previously sent.  The code can also be found in the cgroupns.v6
> > branch of
> >
> > https://git.kernel.org/cgit/linux/kernel/git/sergeh/linux-security.git/
> >
> > To summarize the semantics:
> >
> > 1. CLONE_NEWCGROUP re-uses 0x02000000, which was previously CLONE_STOPPED
> >
> > 2. unsharing a cgroup namespace makes all your current cgroups your new
> > cgroup root.
> >
> > 3. /proc/pid/cgroup always shows cgroup paths relative to the reader's
> > cgroup namespce root.  A task outside of  your cgroup looks like
> >
> >         8:memory:/../../..
> >
> > 4. when a task mounts a cgroupfs, the cgroup which shows up as root depends
> > on the mounting task's  cgroup namespace.
> >
> > 5. setns to a cgroup namespace switches your cgroup namespace but not
> > your cgroups.
> >
> > With this, using github.com/hallyn/lxc #2015-11-09/cgns (and
> > github.com/hallyn/lxcfs #2015-11-10/cgns) we can start a container in a full
> > proper cgroup namespace, avoiding either cgmanager or lxcfs cgroup bind mounts.
> 
> I tested cgroupns.v6 with systemd-nspawn + patches from
> https://github.com/systemd/systemd/pull/2112 using
> unshare(CLONE_NEWCGROUP) booted with
> systemd.unified_cgroup_hierarchy=1 in Fedora22. Tested with and
> without userns. It worked for me :)

Great, thanks for testing.

> Do you need people to run more tests, with other scenarios?

Certainly the more testing the better.  There is a particular set of
cases which I'd earlier tested just in the shell, which could stand
to have a testcase.  That's to basically test all of the '..' possibilities
for /proc/self/cgroup and make sure it's all sane.  I.e. place task t1
into cgroups: '/', '/x1', '/x1/x2', '/x1/x2/x3';  place task t2 into
various relative paths '/', '/x1', '/x1/x2', '/y1', etc;  have t1
check where t2 is, then have t2 setns into t1's namespace and check where
t1 is.

> Do you have patches already for /usr/bin/unshare and /usr/bin/nsenter?

Nope, I don't have patch for util-linux yet, I just used a custom unshare
and setns program.

> > This is completely backward compatible and will be completely invisible
> > to any existing cgroup users (except for those running inside a cgroup
> > namespace and looking at /proc/pid/cgroup of tasks outside their
> > namespace.)
> >
> > Changes from V5:
> > 1. To get a root dentry for cgroup namespace mount, walk the path from the
> >    kernfs root dentry.
> >
> > Changes from V4:
> > 1. Move the FS_USERNS_MOUNT flag to last patch
> > 2. Rebase onto cgroup/for-4.5
> > 3. Don't non-init user namespaces to bind new subsystems when mounting.
> > 4. Address feedback from Tejun (thanks).  Specificaly, not addressed:
> >    . kernfs_obtain_root - walking dentry from kernfs root.
> >      (I think that's the only piece)
> > 5. Dropped unused get_task_cgroup fn/patch.
> > 6. Reworked kernfs_path_from_node_locked() to try to simplify the logic.
> >    It now finds a common ancestor, walks from the source to it, then back
> >    up to the target.
> >
> > Changes from V3:
> > 1. Rebased onto latest cgroup changes.  In particular switch to
> >    css_set_lock and ns_common.
> > 2. Support all hierarchies.
> >
> > Changes from V2:
> > 1. Added documentation in Documentation/cgroups/namespace.txt
> > 2. Fixed a bug that caused crash
> > 3. Incorporated some other suggestions from last patchset:
> >    - removed use of threadgroup_lock() while creating new cgroupns
> >    - use task_lock() instead of rcu_read_lock() while accessing
> >      task->nsproxy
> >    - optimized setns() to own cgroupns
> >    - simplified code around sane-behavior mount option parsing
> > 4. Restored ACKs from Serge Hallyn from v1 on few patches that have
> >    not changed since then.
> >
> > Changes from V1:
> > 1. No pinning of processes within cgroupns. Tasks can be freely moved
> >    across cgroups even outside of their cgroupns-root. Usual DAC/MAC policies
> >    apply as before.
> > 2. Path in /proc/<pid>/cgroup is now always shown and is relative to
> >    cgroupns-root. So path can contain '/..' strings depending on cgroupns-root
> >    of the reader and cgroup of <pid>.
> > 3. setns() does not require the process to first move under target
> >    cgroupns-root.
> >
> > Changes form RFC (V0):
> > 1. setns support for cgroupns
> > 2. 'mount -t cgroup cgroup <mntpt>' from inside a cgroupns now
> >    mounts the cgroup hierarcy with cgroupns-root as the filesystem root.
> > 3. writes to cgroup files outside of cgroupns-root are not allowed
> > 4. visibility of /proc/<pid>/cgroup is further restricted by not showing
> >    anything if the <pid> is in a sibling cgroupns and its cgroup falls outside
> >    your cgroupns-root.
> >
> >
> > _______________________________________________
> > Containers mailing list
> > Containers@lists.linux-foundation.org
> > https://lists.linuxfoundation.org/mailman/listinfo/containers
> _______________________________________________
> Containers mailing list
> Containers@lists.linux-foundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/containers
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]


Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.kernel


csiph-web