All of lore.kernel.org
 help / color / mirror / Atom feed
From: Andrew Morton <akpm@linux-foundation.org>
To: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Cc: Oleg Nesterov <oleg@redhat.com>,
	linux-api@vger.kernel.org, linux-kernel@vger.kernel.org,
	Serge Hallyn <serge.hallyn@ubuntu.com>,
	Nagarathnam Muthusamy <nagarathnam.muthusamy@oracle.com>,
	"Eric W. Biederman" <ebiederm@xmission.com>,
	Eugene Syromiatnikov <esyr@redhat.com>
Subject: Re: [PATCH v4] pidns: introduce syscall translate_pid
Date: Mon, 16 Oct 2017 14:36:28 -0700	[thread overview]
Message-ID: <20171016143628.b2ef80a9ef16d4345889b4d9@linux-foundation.org> (raw)
In-Reply-To: <d7b2a0b6-6d0c-5ca8-9d2b-3a1211713d34@yandex-team.ru>

On Sat, 14 Oct 2017 11:17:47 +0300 Konstantin Khlebnikov <khlebnikov@yandex-team.ru> wrote:

> >>> pid_t translate_pid(pid_t pid, int source, int target);
> >>>
> >>> This syscall converts pid from source pid-ns into pid in target pid-ns.
> >>> If pid is unreachable from target pid-ns it returns zero.
> >>>
> >>> Pid-namespaces are referred file descriptors opened to proc files
> >>> /proc/[pid]/ns/pid or /proc/[pid]/ns/pid_for_children. Negative argument
> >>> refers to current pid namespace, same as file /proc/self/ns/pid.
> >>>
> >>> Kernel expose virtual pids in /proc/[pid]/status:NSpid, but backward
> >>> translation requires scanning all tasks. Also pids could be translated
> >>> by sending them through unix socket between namespaces, this method is
> >>> slow and insecure because other side is exposed inside pid namespace.
> 
> Andrew asked why we might need this.
> 
> Such conversion is required for interaction between processes across pid-namespaces.
> For example to identify process in container by pid file looking from outside.
> 
> Two years ago I've solved this in project of mine with monstrous code which
> forks couple times just to convert pid, lucky for me performance wasn't important.

That's a single user who needed this a single time, and found a
userspace-based solution anyway.  This is not exactly compelling!

Is there a stronger case to be made?  How does this change benefit our
users?  Sell it to us!

WARNING: multiple messages have this Message-ID (diff)
From: Andrew Morton <akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org>
To: Konstantin Khlebnikov
	<khlebnikov-XoJtRXgx1JseBXzfvpsJ4g@public.gmane.org>
Cc: Oleg Nesterov <oleg-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>,
	linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	Serge Hallyn
	<serge.hallyn-GeWIH/nMZzLQT0dZR+AlfA@public.gmane.org>,
	Nagarathnam Muthusamy
	<nagarathnam.muthusamy-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>,
	"Eric W. Biederman"
	<ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>,
	Eugene Syromiatnikov
	<esyr-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
Subject: Re: [PATCH v4] pidns: introduce syscall translate_pid
Date: Mon, 16 Oct 2017 14:36:28 -0700	[thread overview]
Message-ID: <20171016143628.b2ef80a9ef16d4345889b4d9@linux-foundation.org> (raw)
In-Reply-To: <d7b2a0b6-6d0c-5ca8-9d2b-3a1211713d34-XoJtRXgx1JseBXzfvpsJ4g@public.gmane.org>

On Sat, 14 Oct 2017 11:17:47 +0300 Konstantin Khlebnikov <khlebnikov-XoJtRXgx1JseBXzfvpsJ4g@public.gmane.org> wrote:

> >>> pid_t translate_pid(pid_t pid, int source, int target);
> >>>
> >>> This syscall converts pid from source pid-ns into pid in target pid-ns.
> >>> If pid is unreachable from target pid-ns it returns zero.
> >>>
> >>> Pid-namespaces are referred file descriptors opened to proc files
> >>> /proc/[pid]/ns/pid or /proc/[pid]/ns/pid_for_children. Negative argument
> >>> refers to current pid namespace, same as file /proc/self/ns/pid.
> >>>
> >>> Kernel expose virtual pids in /proc/[pid]/status:NSpid, but backward
> >>> translation requires scanning all tasks. Also pids could be translated
> >>> by sending them through unix socket between namespaces, this method is
> >>> slow and insecure because other side is exposed inside pid namespace.
> 
> Andrew asked why we might need this.
> 
> Such conversion is required for interaction between processes across pid-namespaces.
> For example to identify process in container by pid file looking from outside.
> 
> Two years ago I've solved this in project of mine with monstrous code which
> forks couple times just to convert pid, lucky for me performance wasn't important.

That's a single user who needed this a single time, and found a
userspace-based solution anyway.  This is not exactly compelling!

Is there a stronger case to be made?  How does this change benefit our
users?  Sell it to us!

  reply	other threads:[~2017-10-16 21:36 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-10-13  9:26 [PATCH v4] pidns: introduce syscall translate_pid Konstantin Khlebnikov
2017-10-13  9:28 ` Konstantin Khlebnikov
2017-10-13 16:05 ` Oleg Nesterov
2017-10-13 16:13   ` Konstantin Khlebnikov
2017-10-14  8:17     ` Konstantin Khlebnikov
2017-10-14  8:17       ` Konstantin Khlebnikov
2017-10-16 21:36       ` Andrew Morton [this message]
2017-10-16 21:36         ` Andrew Morton
2017-10-16 22:07         ` Nagarathnam Muthusamy
2017-10-16 22:07           ` Nagarathnam Muthusamy
2017-10-16 22:54           ` prakash.sangappa
2017-10-17  0:52             ` Andy Lutomirski
2017-10-17  0:52               ` Andy Lutomirski
2017-10-17 15:38               ` Prakash Sangappa
2017-10-17 22:02                 ` Andy Lutomirski
2017-10-17 22:02                   ` Andy Lutomirski
2017-10-17 22:35                   ` prakash sangappa
2017-10-17 22:35                     ` prakash sangappa
2017-10-17 22:40                     ` Andy Lutomirski
2017-10-17 22:40                       ` Andy Lutomirski
2017-10-17 22:53                       ` prakash sangappa
2017-10-17 22:53                         ` prakash sangappa
2017-11-01 16:59                         ` nagarathnam muthusamy
2017-11-01 17:43                 ` Jann Horn
2017-11-02  0:38                   ` prakash.sangappa
2017-10-16 16:24     ` Oleg Nesterov
2017-10-16 16:24       ` Oleg Nesterov
2017-10-16 21:05       ` Nagarathnam Muthusamy
2017-10-16 21:05         ` Nagarathnam Muthusamy
2017-10-17  7:41         ` Konstantin Khlebnikov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171016143628.b2ef80a9ef16d4345889b4d9@linux-foundation.org \
    --to=akpm@linux-foundation.org \
    --cc=ebiederm@xmission.com \
    --cc=esyr@redhat.com \
    --cc=khlebnikov@yandex-team.ru \
    --cc=linux-api@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nagarathnam.muthusamy@oracle.com \
    --cc=oleg@redhat.com \
    --cc=serge.hallyn@ubuntu.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.