All of lore.kernel.org
 help / color / mirror / Atom feed
From: "J. Bruce Fields" <bfields@fieldses.org>
To: Ian Kent <ikent@redhat.com>
Cc: David Howells <dhowells@redhat.com>,
	Kernel Mailing List <linux-kernel@vger.kernel.org>,
	Oleg Nesterov <onestero@redhat.com>,
	Trond Myklebust <trond.myklebust@primarydata.com>,
	Benjamin Coddington <bcodding@redhat.com>,
	Al Viro <viro@ZenIV.linux.org.uk>,
	Jeff Layton <jeff.layton@primarydata.com>,
	"Eric W. Biederman" <ebiederm@xmission.com>
Subject: Re: [RFC PATCH 5/8] KEYS: exec request-key within the requesting task's init namespace
Date: Wed, 18 Feb 2015 20:31:16 -0500	[thread overview]
Message-ID: <20150219013116.GA13131@fieldses.org> (raw)
In-Reply-To: <1424306341.2649.12.camel@pluto.fritz.box>

On Thu, Feb 19, 2015 at 08:39:01AM +0800, Ian Kent wrote:
> On Wed, 2015-02-18 at 15:59 -0500, J. Bruce Fields wrote:
> > On Wed, Feb 18, 2015 at 12:31:32PM -0500, J. Bruce Fields wrote:
> > > On Wed, Feb 18, 2015 at 12:06:20PM -0500, J. Bruce Fields wrote:
> > > > On Fri, Feb 06, 2015 at 09:47:25AM +0800, Ian Kent wrote:
> > > > > On Thu, 2015-02-05 at 15:14 +0000, David Howells wrote:
> > > > > > 
> > > > > > > +	/* If running within a container use the container namespace */
> > > > > > > +	if (current->nsproxy->net_ns != &init_net)
> > > > > > 
> > > > > > Is that a viable check?  Is it possible to have a container that shares
> > > > > > networking details?
> > > > > 
> > > > > That's up for discussion.
> > > > > 
> > > > > I thought about it and concluded that the check is probably not
> > > > > sufficient for any of the cases.
> > > > > 
> > > > > I left it like that because I'm not sure exactly what the use cases are,
> > > > > hoping it promote discussion and here we are.
> > > > > 
> > > > > I also think the current container environments don't share net
> > > > > namespace with the root init net namspace, necessarily, because thy are
> > > > > containers, ;)
> > > > > 
> > > > > TBH I haven't looked at the user space container creation code but I
> > > > > expect it could be done that way if it was needed, so the answer is yes
> > > > > and no, ;)
> > > > > 
> > > > > The questions then are do we need to check anything else, and what
> > > > > environment should the callback use in the different cases, and what
> > > > > other cases might break if we change it?
> > > > > 
> > > > > For example, should the fs namespace also be checked for all of these
> > > > > cases, since we're executing a callback, or is whatever that's set to in
> > > > > the container always what's required for locating the executable.
> > > > 
> > > > What would be the disadvantage of setting UMH_USE_NS unconditionally
> > > > here?
> > > 
> > > In the nfs idmapping case, the mapping is per-nfs_client.
> > > 
> > > Can nfs_idmap_new be the one that calls umh_get_init_task, with the
> > > corresponding put done in nfs_idmap_delete, or is there some reason that
> > > doesn't work?
> > 
> > It's confusing sorting out possible use cases, but I think both of these
> > are reasonable:
> > 
> > 	- mount an nfs filesystem from the host, then spawn containers
> > 	  that all use that filesystem.
> > 	- mount an nfs filesystem from within a container.
> > 
> > Your approach might work for the second, but in the first case we'll end
> > up with idmappers from multiple containers all trying to do the
> > idmapping for the shared filesystem.
> 
> These patches are examples for context.
> 
> Working out whether to run in a namespace or not was always going to be
> difficult, specifically for the case you point out. Maybe we can make
> use of some other information, namespace information in the super block
> perhaps, or something else, or perhaps we will need to add some
> information for this, not sure yet. We'll need to work together on that.
> 
> TBH, I'm not that focused on the use cases because the base
> implementation is still undergoing significant change although I believe
> the use of a flag to request namespace execution is a good approach.
> That probably won't change.

The flag requests that we use the container of the currently executing
task.  In neither the nfs idmapper nor the nfsd state-recovery case is
that the correct choice.

--b.

  reply	other threads:[~2015-02-19  1:31 UTC|newest]

Thread overview: 48+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-02-05  2:33 [RFC PATCH 0/8] v3 contained usermode helper execution Ian Kent
2015-02-05  2:33 ` [RFC PATCH 1/8] nsproxy - refactor setns() Ian Kent
2015-02-05  2:34 ` [RFC PATCH 2/8] kmod - rename call_usermodehelper() flags parameter Ian Kent
2015-02-05  2:34 ` [RFC PATCH 3/8] kmod - teach call_usermodehelper() to use a namespace Ian Kent
2015-02-06 12:08   ` Jeff Layton
2015-02-08  3:07     ` Ian Kent
2015-02-08 15:22       ` Jeff Layton
2015-02-08 18:12       ` Oleg Nesterov
2015-02-08 19:00   ` Oleg Nesterov
2015-02-09  1:43     ` Ian Kent
2015-02-09 16:03       ` Oleg Nesterov
2015-02-10  0:08         ` Ian Kent
2015-02-10 16:55           ` Oleg Nesterov
2015-02-11  0:40             ` Ian Kent
2015-02-16  6:16             ` Ian Kent
2015-02-16 17:13               ` Oleg Nesterov
2015-02-16 18:24                 ` Oleg Nesterov
2015-02-18  2:09                   ` Ian Kent
2015-02-18  1:42                 ` Ian Kent
2015-02-05  2:34 ` [RFC PATCH 4/8] KEYS - rename call_usermodehelper_keys() flags parameter Ian Kent
2015-02-05  2:34 ` [RFC PATCH 5/8] KEYS: exec request-key within the requesting task's init namespace Ian Kent
2015-02-05  2:34 ` [RFC PATCH 6/8] nfsd - use namespace if not executing in " Ian Kent
2015-02-18 17:37   ` J. Bruce Fields
2015-02-05  2:34 ` [RFC PATCH 7/8] nfs - cache_lib " Ian Kent
2015-02-05  2:34 ` [RFC PATCH 8/8] nfs - objlayout " Ian Kent
2015-02-05 15:01 ` [RFC PATCH 2/8] kmod - rename call_usermodehelper() flags parameter David Howells
2015-02-06  0:01   ` Ian Kent
2015-02-05 15:14 ` [RFC PATCH 5/8] KEYS: exec request-key within the requesting task's init namespace David Howells
2015-02-06  1:47   ` Ian Kent
2015-02-18 17:06     ` J. Bruce Fields
2015-02-18 17:31       ` J. Bruce Fields
2015-02-18 20:59         ` J. Bruce Fields
2015-02-19  0:39           ` Ian Kent
2015-02-19  1:31             ` J. Bruce Fields [this message]
2015-02-19  3:18               ` Ian Kent
2015-02-20  9:33               ` Ian Kent
2015-02-20 17:25                 ` J. Bruce Fields
2015-02-20 18:07                   ` Eric W. Biederman
2015-02-20 18:58                     ` Jeff Layton
2015-02-20 19:05                     ` J. Bruce Fields
2015-02-21  3:58                       ` Ian Kent
2015-02-23 14:52                         ` J. Bruce Fields
2015-02-24  0:50                           ` Ian Kent
2015-02-24  1:22                             ` Benjamin Coddington
2015-02-24  8:01                               ` Ian Kent
2015-02-24 15:33                               ` J. Bruce Fields
2015-02-25  0:41                                 ` Benjamin Coddington
2015-02-05 15:24 ` [RFC PATCH 3/8] kmod - teach call_usermodehelper() to use a namespace David Howells

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20150219013116.GA13131@fieldses.org \
    --to=bfields@fieldses.org \
    --cc=bcodding@redhat.com \
    --cc=dhowells@redhat.com \
    --cc=ebiederm@xmission.com \
    --cc=ikent@redhat.com \
    --cc=jeff.layton@primarydata.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=onestero@redhat.com \
    --cc=trond.myklebust@primarydata.com \
    --cc=viro@ZenIV.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.