Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1586489 > unrolled thread

Re: [GIT PULL] namespaces related fixes for v4.11-rc1

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [GIT PULL] namespaces related fixes for v4.11-rc1 Aleksa Sarai <asarai@suse.de> - 2017-02-22 22:20 +0100
    Re: [GIT PULL] namespaces related fixes for v4.11-rc1 ebiederm@xmission.com (Eric W. Biederman) - 2017-02-23 02:40 +0100
      Re: [GIT PULL] namespaces related fixes for v4.11-rc1 Aleksa Sarai <asarai@suse.de> - 2017-02-23 03:30 +0100
      Re: [GIT PULL] namespaces related fixes for v4.11-rc1 Andy Lutomirski <luto@amacapital.net> - 2017-02-23 04:10 +0100

#1586489 — Re: [GIT PULL] namespaces related fixes for v4.11-rc1

> The only known user of this prctl systemd
> forks all children after the prctl.  So no userspace regressions will
> occur.

Note that runC and containerd (and thus Docker) as well as cri-o use the 
prctl as well -- to be able to collect exit codes from a non-child 
process (namely to collect the exit code from PID 1 in the container).

-- 
Aleksa Sarai
Software Engineer (Containers)
SUSE Linux GmbH
https://www.cyphar.com/

[toc] | [next] | [standalone]

#1586599

Aleksa Sarai <asarai@suse.de> writes:

>> The only known user of this prctl systemd
>> forks all children after the prctl.  So no userspace regressions will
>> occur.
>
> Note that runC and containerd (and thus Docker) as well as cri-o use the prctl
> as well -- to be able to collect exit codes from a non-child process (namely to
> collect the exit code from PID 1 in the container).

Are any of those affected by the change?  I would not expect so.  As it
would require having children or grand children whose exit codes you
don't want to collect.

Eric

[toc] | [prev] | [next] | [standalone]

#1586615

>>> The only known user of this prctl systemd
>>> forks all children after the prctl.  So no userspace regressions will
>>> occur.
>>
>> Note that runC and containerd (and thus Docker) as well as cri-o use the prctl
>> as well -- to be able to collect exit codes from a non-child process (namely to
>> collect the exit code from PID 1 in the container).
>
> Are any of those affected by the change?  I would not expect so.  As it
> would require having children or grand children whose exit codes you
> don't want to collect.

AFAICS they do appear to work (and runC definitely calls the prctl 
before it creates the container init process -- so it shouldn't break 
anything for runC). I was just pointing out that systemd isn't the only 
major userspace user of the prctl (for future reference).

-- 
Aleksa Sarai
Software Engineer (Containers)
SUSE Linux GmbH
https://www.cyphar.com/

[toc] | [prev] | [next] | [standalone]

#1586624

On Wed, Feb 22, 2017 at 5:29 PM, Eric W. Biederman
<ebiederm@xmission.com> wrote:
> Aleksa Sarai <asarai@suse.de> writes:
>
>>> The only known user of this prctl systemd
>>> forks all children after the prctl.  So no userspace regressions will
>>> occur.
>>
>> Note that runC and containerd (and thus Docker) as well as cri-o use the prctl
>> as well -- to be able to collect exit codes from a non-child process (namely to
>> collect the exit code from PID 1 in the container).
>
> Are any of those affected by the change?  I would not expect so.  As it
> would require having children or grand children whose exit codes you
> don't want to collect.

FWIW, I have private code that uses PR_SET_CHILD_SUBREAPER, too.  I
don't see why it would be affected by this change.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web