From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755493AbdJPVgc (ORCPT ); Mon, 16 Oct 2017 17:36:32 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:35508 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755069AbdJPVga (ORCPT ); Mon, 16 Oct 2017 17:36:30 -0400 Date: Mon, 16 Oct 2017 14:36:28 -0700 From: Andrew Morton To: Konstantin Khlebnikov Cc: Oleg Nesterov , linux-api@vger.kernel.org, linux-kernel@vger.kernel.org, Serge Hallyn , Nagarathnam Muthusamy , "Eric W. Biederman" , Eugene Syromiatnikov Subject: Re: [PATCH v4] pidns: introduce syscall translate_pid Message-Id: <20171016143628.b2ef80a9ef16d4345889b4d9@linux-foundation.org> In-Reply-To: References: <150788678482.924140.11785205105514746135.stgit@buzz> <20171013160514.GA27812@redhat.com> <3bdb5341-9ae6-265a-ce5b-45c2cfc76fad@yandex-team.ru> X-Mailer: Sylpheed 3.4.1 (GTK+ 2.24.23; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, 14 Oct 2017 11:17:47 +0300 Konstantin Khlebnikov wrote: > >>> pid_t translate_pid(pid_t pid, int source, int target); > >>> > >>> This syscall converts pid from source pid-ns into pid in target pid-ns. > >>> If pid is unreachable from target pid-ns it returns zero. > >>> > >>> Pid-namespaces are referred file descriptors opened to proc files > >>> /proc/[pid]/ns/pid or /proc/[pid]/ns/pid_for_children. Negative argument > >>> refers to current pid namespace, same as file /proc/self/ns/pid. > >>> > >>> Kernel expose virtual pids in /proc/[pid]/status:NSpid, but backward > >>> translation requires scanning all tasks. Also pids could be translated > >>> by sending them through unix socket between namespaces, this method is > >>> slow and insecure because other side is exposed inside pid namespace. > > Andrew asked why we might need this. > > Such conversion is required for interaction between processes across pid-namespaces. > For example to identify process in container by pid file looking from outside. > > Two years ago I've solved this in project of mine with monstrous code which > forks couple times just to convert pid, lucky for me performance wasn't important. That's a single user who needed this a single time, and found a userspace-based solution anyway. This is not exactly compelling! Is there a stronger case to be made? How does this change benefit our users? Sell it to us! From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andrew Morton Subject: Re: [PATCH v4] pidns: introduce syscall translate_pid Date: Mon, 16 Oct 2017 14:36:28 -0700 Message-ID: <20171016143628.b2ef80a9ef16d4345889b4d9@linux-foundation.org> References: <150788678482.924140.11785205105514746135.stgit@buzz> <20171013160514.GA27812@redhat.com> <3bdb5341-9ae6-265a-ce5b-45c2cfc76fad@yandex-team.ru> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: Sender: linux-api-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Konstantin Khlebnikov Cc: Oleg Nesterov , linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Serge Hallyn , Nagarathnam Muthusamy , "Eric W. Biederman" , Eugene Syromiatnikov List-Id: linux-api@vger.kernel.org On Sat, 14 Oct 2017 11:17:47 +0300 Konstantin Khlebnikov wrote: > >>> pid_t translate_pid(pid_t pid, int source, int target); > >>> > >>> This syscall converts pid from source pid-ns into pid in target pid-ns. > >>> If pid is unreachable from target pid-ns it returns zero. > >>> > >>> Pid-namespaces are referred file descriptors opened to proc files > >>> /proc/[pid]/ns/pid or /proc/[pid]/ns/pid_for_children. Negative argument > >>> refers to current pid namespace, same as file /proc/self/ns/pid. > >>> > >>> Kernel expose virtual pids in /proc/[pid]/status:NSpid, but backward > >>> translation requires scanning all tasks. Also pids could be translated > >>> by sending them through unix socket between namespaces, this method is > >>> slow and insecure because other side is exposed inside pid namespace. > > Andrew asked why we might need this. > > Such conversion is required for interaction between processes across pid-namespaces. > For example to identify process in container by pid file looking from outside. > > Two years ago I've solved this in project of mine with monstrous code which > forks couple times just to convert pid, lucky for me performance wasn't important. That's a single user who needed this a single time, and found a userspace-based solution anyway. This is not exactly compelling! Is there a stronger case to be made? How does this change benefit our users? Sell it to us!