Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1270530 > unrolled thread

CGroup Namespaces (v4)

Back to article view | Back to linux.kernel

Contents

  CGroup Namespaces (v4) serge@hallyn.com - 2015-11-16 21:00 +0100
    [PATCH 4/8] cgroup: export cgroup_get() and cgroup_put() serge@hallyn.com - 2015-11-16 21:00 +0100
      Re: [PATCH 4/8] cgroup: export cgroup_get() and cgroup_put() Tejun Heo <tj@kernel.org> - 2015-11-24 17:40 +0100
        Re: [PATCH 4/8] cgroup: export cgroup_get() and cgroup_put() "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-11-24 23:40 +0100
    [PATCH 6/8] cgroup: cgroup namespace setns support serge@hallyn.com - 2015-11-16 21:00 +0100
      Re: [PATCH 6/8] cgroup: cgroup namespace setns support Tejun Heo <tj@kernel.org> - 2015-11-24 18:00 +0100
    [PATCH 1/8] kernfs: Add API to generate relative kernfs path serge@hallyn.com - 2015-11-16 21:00 +0100
      Re: [PATCH 1/8] kernfs: Add API to generate relative kernfs path Tejun Heo <tj@kernel.org> - 2015-11-24 17:20 +0100
        Re: [PATCH 1/8] kernfs: Add API to generate relative kernfs path "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-11-24 18:50 +0100
      Re: [PATCH 1/8] kernfs: Add API to generate relative kernfs path Tejun Heo <tj@kernel.org> - 2015-11-24 17:20 +0100
        Re: [PATCH 1/8] kernfs: Add API to generate relative kernfs path "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-11-27 06:30 +0100
          Re: [PATCH 1/8] kernfs: Add API to generate relative kernfs path Tejun Heo <tj@kernel.org> - 2015-11-30 16:20 +0100
    Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-16 21:50 +0100
      Re: CGroup Namespaces (v4) Richard Weinberger <richard@nod.at> - 2015-11-16 22:00 +0100
        Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-16 22:00 +0100
          Re: CGroup Namespaces (v4) ebiederm@xmission.com (Eric W. Biederman) - 2015-11-16 23:40 +0100
            Re: CGroup Namespaces (v4) Tejun Heo <tj@kernel.org> - 2015-11-16 23:40 +0100
            Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-17 02:20 +0100
              Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-17 02:50 +0100
                Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-17 05:00 +0100
            Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-18 03:40 +0100
              Re: CGroup Namespaces (v4) ebiederm@xmission.com (Eric W. Biederman) - 2015-11-18 10:30 +0100
                Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-11-18 16:50 +0100
    Re: CGroup Namespaces (v4) Richard Weinberger <richard.weinberger@gmail.com> - 2015-11-16 21:50 +0100

Page 2 of 2 — ← Prev page 1 [2]

#1271818

On Mon, Nov 16, 2015 at 04:24:27PM -0600, Eric W. Biederman wrote:
> Similary have you considered what it required to be able to safely set
> FS_USERNS_MOUNT?

I pushed the one patch which I feel is needed to my branch (it's also
included in another reply).  Aditya had already added FS_USERNS_MOUNT to
the cgroup fs flags, so I think we're now all set.  I can start
unprivileged containers which mount cgroupfs (which make systemd happy).

-serge
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1272035

"Serge E. Hallyn" <serge@hallyn.com> writes:

> On Mon, Nov 16, 2015 at 04:24:27PM -0600, Eric W. Biederman wrote:
>> Similary have you considered what it required to be able to safely set
>> FS_USERNS_MOUNT?
>
> I pushed the one patch which I feel is needed to my branch (it's also
> included in another reply).  Aditya had already added FS_USERNS_MOUNT to
> the cgroup fs flags, so I think we're now all set.  I can start
> unprivileged containers which mount cgroupfs (which make systemd happy).

In principle that sounds very good, and I am glad to see that.

Let's hold off on merging the unprivileged part until everything else is
reviewed and merged and we have performed an extra hard look at the
security implications as it can be easy to overlook something when
relaxing the permissions.

Eric

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1272315

On Wed, Nov 18, 2015 at 03:18:44AM -0600, Eric W. Biederman wrote:
> "Serge E. Hallyn" <serge@hallyn.com> writes:
> 
> > On Mon, Nov 16, 2015 at 04:24:27PM -0600, Eric W. Biederman wrote:
> >> Similary have you considered what it required to be able to safely set
> >> FS_USERNS_MOUNT?
> >
> > I pushed the one patch which I feel is needed to my branch (it's also
> > included in another reply).  Aditya had already added FS_USERNS_MOUNT to
> > the cgroup fs flags, so I think we're now all set.  I can start
> > unprivileged containers which mount cgroupfs (which make systemd happy).
> 
> In principle that sounds very good, and I am glad to see that.
> 
> Let's hold off on merging the unprivileged part until everything else is
> reviewed and merged and we have performed an extra hard look at the
> security implications as it can be easy to overlook something when
> relaxing the permissions.

I'll break out the FS_USERNS_MOUNT flag into the very last patch.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1270567

Serge,

On Mon, Nov 16, 2015 at 8:51 PM,  <serge@hallyn.com> wrote:
> To summarize the semantics:
>
> 1. CLONE_NEWCGROUP re-uses 0x02000000, which was previously CLONE_STOPPED
>
> 2. unsharing a cgroup namespace makes all your current cgroups your new
> cgroup root.
>
> 3. /proc/pid/cgroup always shows cgroup paths relative to the reader's
> cgroup namespce root.  A task outside of  your cgroup looks like
>
>         8:memory:/../../..
>
> 4. when a task mounts a cgroupfs, the cgroup which shows up as root depends
> on the mounting task's  cgroup namespace.
>
> 5. setns to a cgroup namespace switches your cgroup namespace but not
> your cgroups.
>
> With this, using github.com/hallyn/lxc #2015-11-09/cgns (and
> github.com/hallyn/lxcfs #2015-11-10/cgns) we can start a container in a full
> proper cgroup namespace, avoiding either cgmanager or lxcfs cgroup bind mounts.
>
> This is completely backward compatible and will be completely invisible
> to any existing cgroup users (except for those running inside a cgroup
> namespace and looking at /proc/pid/cgroup of tasks outside their
> namespace.)
>    cgroupns-root.

IIRC one downside of this series was that only the new "sane" cgroup
layout was supported
and hence it was useless for everything which expected the default layout.
Hence, still no systemd for us. :)

Is this now different?

-- 
Thanks,
//richard
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.kernel

csiph-web