Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1332425 > unrolled thread

Re: [lxc-devel] CGroup Namespaces (v10)

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [lxc-devel] CGroup Namespaces (v10) Alban Crequy <alban.crequy@gmail.com> - 2016-02-12 00:20 +0100
    Re: [lxc-devel] CGroup Namespaces (v10) Tejun Heo <tj@kernel.org> - 2016-02-12 17:10 +0100
      Re: [lxc-devel] CGroup Namespaces (v10) "Serge E. Hallyn" <serge@hallyn.com> - 2016-02-13 00:30 +0100
        Re: [lxc-devel] CGroup Namespaces (v10) Tejun Heo <tj@kernel.org> - 2016-02-15 22:20 +0100
          Re: [lxc-devel] CGroup Namespaces (v10) Tejun Heo <tj@kernel.org> - 2016-02-15 22:30 +0100

#1332425 — Re: [lxc-devel] CGroup Namespaces (v10)

On 29 January 2016 at 09:54,  <serge.hallyn@ubuntu.com> wrote:
> Hi,
>
> following is a revised set of the CGroup Namespace patchset which Aditya
> Kali has previously sent.  The code can also be found in the cgroupns.v10
> branch of
>
> https://git.kernel.org/cgit/linux/kernel/git/sergeh/linux-security.git/
>
> To summarize the semantics:
>
> 1. CLONE_NEWCGROUP re-uses 0x02000000, which was previously CLONE_STOPPED
>
> 2. unsharing a cgroup namespace makes all your current cgroups your new
> cgroup root.
>
> 3. /proc/pid/cgroup always shows cgroup paths relative to the reader's
> cgroup namespce root.  A task outside of  your cgroup looks like
>
>         8:memory:/../../..
>
> 4. when a task mounts a cgroupfs, the cgroup which shows up as root depends
> on the mounting task's  cgroup namespace.
>
> 5. setns to a cgroup namespace switches your cgroup namespace but not
> your cgroups.
>
> With this, using github.com/hallyn/lxc #2015-11-09/cgns (and
> github.com/hallyn/lxcfs #2015-11-10/cgns) we can start a container in a full
> proper cgroup namespace, avoiding either cgmanager or lxcfs cgroup bind mounts.
>
> This is completely backward compatible and will be completely invisible
> to any existing cgroup users (except for those running inside a cgroup
> namespace and looking at /proc/pid/cgroup of tasks outside their
> namespace.)

Hi,

I just noticed commit c38c4597e4bf ("netfilter: implement xt_cgroup
cgroup2 path match") which, as far as I understand, introduces a new
userland facing API containing the full cgroup path. Does it mean that
the cgroupns patchset should include cgroup path translation in
xt_cgroup?

> Changes from V9:
> 1. Update to latest Linus tree
> 2. A few locking fixes
>
> Changes from V8:
> 1. Incorporate updated documentation from tj.
> 2. Put lookup_one_len() under inode lock
> 3. Make cgroup_path non-namespaced, so only calls to cgroup_path_ns() are
>    namespaced.
> 4. Make cgroup_path{,_ns} take the needed locks, since external callers cannot
>    do so.
> 5. Fix the bisectability problem of to_cg_ns() being defined after use
>
> Changes from V7:
> 1. Rework kernfs_path_from_node_locked to return the string length
> 2. Rename and reorder args to kernfs_path_from_node
> 3. cgroup.c: undo accidental conversoins to inline
> 4. cgroup.h: move ns declarations to bottom.
> 5. Rework the documentation to fit the style of the rest of cgroup.txt
>
> Changes from V6:
> 1. Switch to some WARN_ONs to provide stack traces
> 2. Rename kernfs_node_distance to kernfs_depth
> 3. Make sure kernfs_common_ancestor() nodes are from same root
> 4. Split kernfs changes for cgroup_mount into separate patch
> 5. Rename kernfs_obtain_root to kernfs_node_dentry
> (And more, see patch changelogs)
>
> Changes from V5:
> 1. To get a root dentry for cgroup namespace mount, walk the path from the
>    kernfs root dentry.
>
> Changes from V4:
> 1. Move the FS_USERNS_MOUNT flag to last patch
> 2. Rebase onto cgroup/for-4.5
> 3. Don't non-init user namespaces to bind new subsystems when mounting.
> 4. Address feedback from Tejun (thanks).  Specificaly, not addressed:
>    . kernfs_obtain_root - walking dentry from kernfs root.
>      (I think that's the only piece)
> 5. Dropped unused get_task_cgroup fn/patch.
> 6. Reworked kernfs_path_from_node_locked() to try to simplify the logic.
>    It now finds a common ancestor, walks from the source to it, then back
>    up to the target.
>
> Changes from V3:
> 1. Rebased onto latest cgroup changes.  In particular switch to
>    css_set_lock and ns_common.
> 2. Support all hierarchies.
>
> Changes from V2:
> 1. Added documentation in Documentation/cgroups/namespace.txt
> 2. Fixed a bug that caused crash
> 3. Incorporated some other suggestions from last patchset:
>    - removed use of threadgroup_lock() while creating new cgroupns
>    - use task_lock() instead of rcu_read_lock() while accessing
>      task->nsproxy
>    - optimized setns() to own cgroupns
>    - simplified code around sane-behavior mount option parsing
> 4. Restored ACKs from Serge Hallyn from v1 on few patches that have
>    not changed since then.
>
> Changes from V1:
> 1. No pinning of processes within cgroupns. Tasks can be freely moved
>    across cgroups even outside of their cgroupns-root. Usual DAC/MAC policies
>    apply as before.
> 2. Path in /proc/<pid>/cgroup is now always shown and is relative to
>    cgroupns-root. So path can contain '/..' strings depending on cgroupns-root
>    of the reader and cgroup of <pid>.
> 3. setns() does not require the process to first move under target
>    cgroupns-root.
>
> Changes form RFC (V0):
> 1. setns support for cgroupns
> 2. 'mount -t cgroup cgroup <mntpt>' from inside a cgroupns now
>    mounts the cgroup hierarcy with cgroupns-root as the filesystem root.
> 3. writes to cgroup files outside of cgroupns-root are not allowed
> 4. visibility of /proc/<pid>/cgroup is further restricted by not showing
>    anything if the <pid> is in a sibling cgroupns and its cgroup falls outside
>    your cgroupns-root.
>
>
> _______________________________________________
> lxc-devel mailing list
> lxc-devel@lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel

[toc] | [next] | [standalone]

#1332845

Hello,

On Fri, Feb 12, 2016 at 12:18:28AM +0100, Alban Crequy wrote:
> I just noticed commit c38c4597e4bf ("netfilter: implement xt_cgroup
> cgroup2 path match") which, as far as I understand, introduces a new
> userland facing API containing the full cgroup path. Does it mean that
> the cgroupns patchset should include cgroup path translation in
> xt_cgroup?

I don't think so.  None of netfilter configuration is namespaced in
any way.  They're system-global by nature.

Thanks.

-- 
tejun

[toc] | [prev] | [next] | [standalone]

#1333209

On Fri, Feb 12, 2016 at 11:09:06AM -0500, Tejun Heo wrote:
> Hello,
> 
> On Fri, Feb 12, 2016 at 12:18:28AM +0100, Alban Crequy wrote:
> > I just noticed commit c38c4597e4bf ("netfilter: implement xt_cgroup
> > cgroup2 path match") which, as far as I understand, introduces a new
> > userland facing API containing the full cgroup path. Does it mean that
> > the cgroupns patchset should include cgroup path translation in
> > xt_cgroup?
> 
> I don't think so.  None of netfilter configuration is namespaced in
> any way.  They're system-global by nature.

I assume at some point you'll want the set ported onto for-4.6 or
linux-next?  My 2016-02-03/cgns set still cherrypick cleanly onto
for-4.6 at the moment, but I haven't tried linux-next, and I haven't
done build+test since 4.5-rc1 came out.

thanks,
-serge

[toc] | [prev] | [next] | [standalone]

#1334834

On Fri, Feb 12, 2016 at 05:22:21PM -0600, Serge E. Hallyn wrote:
> On Fri, Feb 12, 2016 at 11:09:06AM -0500, Tejun Heo wrote:
> > Hello,
> > 
> > On Fri, Feb 12, 2016 at 12:18:28AM +0100, Alban Crequy wrote:
> > > I just noticed commit c38c4597e4bf ("netfilter: implement xt_cgroup
> > > cgroup2 path match") which, as far as I understand, introduces a new
> > > userland facing API containing the full cgroup path. Does it mean that
> > > the cgroupns patchset should include cgroup path translation in
> > > xt_cgroup?
> > 
> > I don't think so.  None of netfilter configuration is namespaced in
> > any way.  They're system-global by nature.
> 
> I assume at some point you'll want the set ported onto for-4.6 or
> linux-next?  My 2016-02-03/cgns set still cherrypick cleanly onto
> for-4.6 at the moment, but I haven't tried linux-next, and I haven't
> done build+test since 4.5-rc1 came out.

I'm getting the following on top of the current for-4.6.  Can you
please look into it?

[kernel/cgroup.c:219:13: error: ‘cgroupns_operations’ undeclared here (not in a function)
  .ns.ops  = &cgroupns_operations,
               ^

Thanks.

-- 
tejun

[toc] | [prev] | [next] | [standalone]

#1334837

On Mon, Feb 15, 2016 at 04:17:05PM -0500, Tejun Heo wrote:
> I'm getting the following on top of the current for-4.6.  Can you
> please look into it?
> 
> [kernel/cgroup.c:219:13: error: ‘cgroupns_operations’ undeclared here (not in a function)
>   .ns.ops  = &cgroupns_operations,
>                ^

Never mind.  That was me being stupid with trivial conflict
resolution.

Thanks.

-- 
tejun

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web