Re: [PATCH RFC] pidns: introduce syscall getvpid

From: Stéphane Graber
Date: Tue Sep 15 2015 - 11:26:20 EST


On Tue, Sep 15, 2015 at 06:01:38PM +0300, Konstantin Khlebnikov wrote:
> On 15.09.2015 17:27, Eric W. Biederman wrote:
> >Konstantin Khlebnikov <khlebnikov@xxxxxxxxxxxxxx> writes:
> >
> >>pid_t getvpid(pid_t pid, pid_t source, pid_t target);
> >>
> >>This syscall converts pid from one pid-ns into pid in another pid-ns:
> >>it takes @pid in namespace of @source task (zero for current) and
> >>returns related pid in namespace of @target task (zero for current too).
> >>If pid is unreachable from target pid-ns then it returns zero.
> >
> >This interface as presented is inherently racy. It would be better
> >if source and target were file descriptors referring to the namespaces
> >you wish to translate between.
>
> Yep, it's racy. As well as any operation with non-child pids.
> With file descriptors for source/target result will be racy anyway.
>
> >
> >>Such conversion is required for interaction between processes from
> >>different pid-namespaces. For example when system service talks with
> >>client from isolated container via socket about task in container:
> >
> >Sockets are already supported. At least the metadata of sockets is.
> >
> >Maybe we need this but I am not convinced of it's utility.
> >
> >What are you trying to do that motivates this?
>
> I'm working on hierarchical container management system which
> allows to create and control nested sub-containers from containers
> ( https://github.com/yandex/porto ). Main server works in host and
> have to interact with all levels of nested namespaces. This syscall
> makes some operations much easier: server must remember only pid in
> host pid namespace and convert it into right vpid on demand.

Note that as Eric said earlier, sending a PID inside a ucred through a
unix socket will have the pid translated.

So while your solution certainly should be faster, you can already achieve
what you want today by doing:

== Translate PID in container to PID in host
- open a socket
- setns to container's pidns
- send ucred from that container containing the requested container PID
- host sees the host PID

== Translate PID on host to PID in container
- open a socket
- setns to container's pidns
- send ucred from the host containing the request host PID
(send will fail if the host PID isn't part of that container)
- container sees the container PID

>
> >
> >Eric
> >
> >
> >>getvpid(pid, client_pid, 0) -> pid in our pid namespace
> >>getvpid(pid, 0, client_pid) -> pid in client pid namespace
> >>
> >>Also service can get pid of init task and match it with container:
> >>
> >>getvpid(1, client_pid, 0) -> pid of init task for client_pid
> >>
> >>Seems like gdb and strace could use this too for converting pids of
> >>newly forked tasks (IIRR they get pid from %rax) into pid from
> >>correct namespace for further interaction.
> >>
> >>As a bonus syscall getvpid can compare pid namespaces and
> >>test isolation without mounted procfs:
> >>
> >>getvpid(1, 0, pid) == 0 -> pid in our sub-pid-namespace
> >>getvpid(1, 0, pid) == 1 -> pid in our pid-namespace
> >>getvpid(1, pid1, pid2) == 0 -> pid1 isolated from pid2
> >>getvpid(1, pid1, pid2) == 1 -> tasks are in one pid-namespace
> >>getvpid(1, pid1, pid2) > 1 -> pid1 is in sub-pidns of pid2
> >>
> >>Signed-off-by: Konstantin Khlebnikov <khlebnikov@xxxxxxxxxxxxxx>
> >>---
> >> arch/x86/entry/syscalls/syscall_32.tbl | 1 +
> >> arch/x86/entry/syscalls/syscall_64.tbl | 1 +
> >> include/linux/syscalls.h | 1 +
> >> kernel/pid.c | 36 ++++++++++++++++++++++++++++++++
> >> 4 files changed, 39 insertions(+)
> >>
> >>diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscalls/syscall_32.tbl
> >>index 7663c455b9f6..dadb55d42fc9 100644
> >>--- a/arch/x86/entry/syscalls/syscall_32.tbl
> >>+++ b/arch/x86/entry/syscalls/syscall_32.tbl
> >>@@ -382,3 +382,4 @@
> >> 373 i386 shutdown sys_shutdown
> >> 374 i386 userfaultfd sys_userfaultfd
> >> 375 i386 membarrier sys_membarrier
> >>+376 i386 getvpid sys_getvpid
> >>diff --git a/arch/x86/entry/syscalls/syscall_64.tbl b/arch/x86/entry/syscalls/syscall_64.tbl
> >>index 278842fdf1f6..0338f2eb3b7c 100644
> >>--- a/arch/x86/entry/syscalls/syscall_64.tbl
> >>+++ b/arch/x86/entry/syscalls/syscall_64.tbl
> >>@@ -331,6 +331,7 @@
> >> 322 64 execveat stub_execveat
> >> 323 common userfaultfd sys_userfaultfd
> >> 324 common membarrier sys_membarrier
> >>+325 common getvpid sys_getvpid
> >>
> >> #
> >> # x32-specific system call numbers start at 512 to avoid cache impact
> >>diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
> >>index a460e2ef2843..3405c30999e3 100644
> >>--- a/include/linux/syscalls.h
> >>+++ b/include/linux/syscalls.h
> >>@@ -222,6 +222,7 @@ asmlinkage long sys_nanosleep(struct timespec __user *rqtp, struct timespec __us
> >> asmlinkage long sys_alarm(unsigned int seconds);
> >> asmlinkage long sys_getpid(void);
> >> asmlinkage long sys_getppid(void);
> >>+asmlinkage long sys_getvpid(pid_t pid, pid_t source, pid_t target);
> >> asmlinkage long sys_getuid(void);
> >> asmlinkage long sys_geteuid(void);
> >> asmlinkage long sys_getgid(void);
> >>diff --git a/kernel/pid.c b/kernel/pid.c
> >>index ca368793808e..caa676ff7364 100644
> >>--- a/kernel/pid.c
> >>+++ b/kernel/pid.c
> >>@@ -567,6 +567,42 @@ struct pid *find_ge_pid(int nr, struct pid_namespace *ns)
> >> return pid;
> >> }
> >>
> >>+/**
> >>+ * sys_getvpid - convert pid from one pid-namespace into pid from another
> >>+ *
> >>+ * @pid - pid of requested task
> >>+ * @source - pid of task in source pid-namespace, zero for current
> >>+ * @target - pid of task in target pid-namespace, zero for current
> >>+ *
> >>+ * Returns pid from target pid-ns or zero if pid is unreachable.
> >>+ * Returns -ESRCH if some of pids are not found.
> >>+ */
> >>+SYSCALL_DEFINE3(getvpid, pid_t, pid, pid_t, source, pid_t, target)
> >>+{
> >>+#ifdef CONFIG_PID_NS
> >>+ struct pid_namespace *current_ns = task_active_pid_ns(current);
> >>+ struct pid_namespace *source_ns = current_ns, *target_ns = current_ns;
> >>+ struct pid *task_pid;
> >>+ pid_t result = -ESRCH;
> >>+
> >>+ rcu_read_lock();
> >>+ if (source)
> >>+ source_ns = ns_of_pid(find_pid_ns(source, current_ns));
> >>+ if (target)
> >>+ target_ns = ns_of_pid(find_pid_ns(target, current_ns));
> >>+ if (source_ns && target_ns) {
> >>+ task_pid = find_pid_ns(pid, source_ns);
> >>+ if (task_pid)
> >>+ result = pid_nr_ns(task_pid, target_ns);
> >>+ }
> >>+ rcu_read_unlock();
> >>+
> >>+ return result;
> >>+#else
> >>+ return pid;
> >>+#endif /* CONFIG_PID_NS */
> >>+}
> >>+
> >> /*
> >> * The pid hash table is scaled according to the amount of memory in the
> >> * machine. From a minimum of 16 slots up to 4096 slots at one gigabyte or
>
>
> --
> Konstantin
> _______________________________________________
> Containers mailing list
> Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx
> https://lists.linuxfoundation.org/mailman/listinfo/containers

--
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com

Attachment: signature.asc
Description: Digital signature