Re: [PATCH RFC] pidns: introduce syscall getvpid
From: Konstantin Khlebnikov
Date: Tue Sep 15 2015 - 12:00:40 EST
On 15.09.2015 18:17, Stéphane Graber wrote:
On Tue, Sep 15, 2015 at 06:01:38PM +0300, Konstantin Khlebnikov wrote:
On 15.09.2015 17:27, Eric W. Biederman wrote:
Konstantin Khlebnikov <khlebnikov@xxxxxxxxxxxxxx> writes:
pid_t getvpid(pid_t pid, pid_t source, pid_t target);
This syscall converts pid from one pid-ns into pid in another pid-ns:
it takes @pid in namespace of @source task (zero for current) and
returns related pid in namespace of @target task (zero for current too).
If pid is unreachable from target pid-ns then it returns zero.
This interface as presented is inherently racy. It would be better
if source and target were file descriptors referring to the namespaces
you wish to translate between.
Yep, it's racy. As well as any operation with non-child pids.
With file descriptors for source/target result will be racy anyway.
Such conversion is required for interaction between processes from
different pid-namespaces. For example when system service talks with
client from isolated container via socket about task in container:
Sockets are already supported. At least the metadata of sockets is.
Maybe we need this but I am not convinced of it's utility.
What are you trying to do that motivates this?
I'm working on hierarchical container management system which
allows to create and control nested sub-containers from containers
( https://github.com/yandex/porto ). Main server works in host and
have to interact with all levels of nested namespaces. This syscall
makes some operations much easier: server must remember only pid in
host pid namespace and convert it into right vpid on demand.
Note that as Eric said earlier, sending a PID inside a ucred through a
unix socket will have the pid translated.
We are using this already: clients in container connect to unix-socket
binded in host net-ns and bind-mounted into container =)
Server identifies them by pid from SO_PEERCRED
So while your solution certainly should be faster, you can already achieve
what you want today by doing:
== Translate PID in container to PID in host
- open a socket
- setns to container's pidns
- send ucred from that container containing the requested container PID
- host sees the host PID
That's funny. But setns isn't enough,
task have to fork into pid-namespace.
== Translate PID on host to PID in container
- open a socket
- setns to container's pidns
- send ucred from the host containing the request host PID
(send will fail if the host PID isn't part of that container)
- container sees the container PID
Eric
getvpid(pid, client_pid, 0) -> pid in our pid namespace
getvpid(pid, 0, client_pid) -> pid in client pid namespace
Also service can get pid of init task and match it with container:
getvpid(1, client_pid, 0) -> pid of init task for client_pid
Seems like gdb and strace could use this too for converting pids of
newly forked tasks (IIRR they get pid from %rax) into pid from
correct namespace for further interaction.
As a bonus syscall getvpid can compare pid namespaces and
test isolation without mounted procfs:
getvpid(1, 0, pid) == 0 -> pid in our sub-pid-namespace
getvpid(1, 0, pid) == 1 -> pid in our pid-namespace
getvpid(1, pid1, pid2) == 0 -> pid1 isolated from pid2
getvpid(1, pid1, pid2) == 1 -> tasks are in one pid-namespace
getvpid(1, pid1, pid2) > 1 -> pid1 is in sub-pidns of pid2
Signed-off-by: Konstantin Khlebnikov <khlebnikov@xxxxxxxxxxxxxx>
---
arch/x86/entry/syscalls/syscall_32.tbl | 1 +
arch/x86/entry/syscalls/syscall_64.tbl | 1 +
include/linux/syscalls.h | 1 +
kernel/pid.c | 36 ++++++++++++++++++++++++++++++++
4 files changed, 39 insertions(+)
diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscalls/syscall_32.tbl
index 7663c455b9f6..dadb55d42fc9 100644
--- a/arch/x86/entry/syscalls/syscall_32.tbl
+++ b/arch/x86/entry/syscalls/syscall_32.tbl
@@ -382,3 +382,4 @@
373 i386 shutdown sys_shutdown
374 i386 userfaultfd sys_userfaultfd
375 i386 membarrier sys_membarrier
+376 i386 getvpid sys_getvpid
diff --git a/arch/x86/entry/syscalls/syscall_64.tbl b/arch/x86/entry/syscalls/syscall_64.tbl
index 278842fdf1f6..0338f2eb3b7c 100644
--- a/arch/x86/entry/syscalls/syscall_64.tbl
+++ b/arch/x86/entry/syscalls/syscall_64.tbl
@@ -331,6 +331,7 @@
322 64 execveat stub_execveat
323 common userfaultfd sys_userfaultfd
324 common membarrier sys_membarrier
+325 common getvpid sys_getvpid
#
# x32-specific system call numbers start at 512 to avoid cache impact
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index a460e2ef2843..3405c30999e3 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -222,6 +222,7 @@ asmlinkage long sys_nanosleep(struct timespec __user *rqtp, struct timespec __us
asmlinkage long sys_alarm(unsigned int seconds);
asmlinkage long sys_getpid(void);
asmlinkage long sys_getppid(void);
+asmlinkage long sys_getvpid(pid_t pid, pid_t source, pid_t target);
asmlinkage long sys_getuid(void);
asmlinkage long sys_geteuid(void);
asmlinkage long sys_getgid(void);
diff --git a/kernel/pid.c b/kernel/pid.c
index ca368793808e..caa676ff7364 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -567,6 +567,42 @@ struct pid *find_ge_pid(int nr, struct pid_namespace *ns)
return pid;
}
+/**
+ * sys_getvpid - convert pid from one pid-namespace into pid from another
+ *
+ * @pid - pid of requested task
+ * @source - pid of task in source pid-namespace, zero for current
+ * @target - pid of task in target pid-namespace, zero for current
+ *
+ * Returns pid from target pid-ns or zero if pid is unreachable.
+ * Returns -ESRCH if some of pids are not found.
+ */
+SYSCALL_DEFINE3(getvpid, pid_t, pid, pid_t, source, pid_t, target)
+{
+#ifdef CONFIG_PID_NS
+ struct pid_namespace *current_ns = task_active_pid_ns(current);
+ struct pid_namespace *source_ns = current_ns, *target_ns = current_ns;
+ struct pid *task_pid;
+ pid_t result = -ESRCH;
+
+ rcu_read_lock();
+ if (source)
+ source_ns = ns_of_pid(find_pid_ns(source, current_ns));
+ if (target)
+ target_ns = ns_of_pid(find_pid_ns(target, current_ns));
+ if (source_ns && target_ns) {
+ task_pid = find_pid_ns(pid, source_ns);
+ if (task_pid)
+ result = pid_nr_ns(task_pid, target_ns);
+ }
+ rcu_read_unlock();
+
+ return result;
+#else
+ return pid;
+#endif /* CONFIG_PID_NS */
+}
+
/*
* The pid hash table is scaled according to the amount of memory in the
* machine. From a minimum of 16 slots up to 4096 slots at one gigabyte or
--
Konstantin
_______________________________________________
Containers mailing list
Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linuxfoundation.org/mailman/listinfo/containers
--
Konstantin
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/