Messages in this thread | | | Date | Tue, 25 Nov 2014 22:52:48 +0100 | From | Oleg Nesterov <> | Subject | Re: [RFC PATCH 3/4] kmod - add call_usermodehelper_ns() helper |
| |
Let me first apologize, I didn't actually read this series yet.
But I have to admit that so far I do not like this approach... probably I am biased.
On 11/25, Ian Kent wrote: > > The call_usermodehelper() function executes all binaries in the > global "init" root context. This doesn't allow a binary to be run > within the callers namespace (aka. a container).
Please see below.
> Both containerized NFS client and NFS server need the ability to > execute a binary within their container. To do this create a new > nsproxy within the callers' context so it can be used for setup > prior to calling do_execve() from the user mode helper thread > runner.
and probably we also need this for coredump helpers, we want them to be per-namespace.
> +static int umh_set_ns(struct subprocess_info *info, struct cred *new) > +{ > + struct nsproxy *ns = info->data; > + > + mntns_setfs(ns->mnt_ns);
Firstly, it is not clear to me if we should use the caller's ->mnt_ns. Let me remind about the coredump. The dumping task can cloned with CLONE_NEWNS or it cam do unshare(NEWNS)... but OK, I do not understand this enough.
> + switch_task_namespaces(current, ns);
This doesn't look sane because this won't switch task_active_pid_ns().
And this reminds me another discussion, please look at http://marc.info/?l=linux-kernel&m=138479570926192
Once again, this is just an idea to provoke more discussion. I am starting to think that perhaps we need pid_ns->umh_helper (init by default). And PR_SET_NS_UMH_HELPER.
Not sure.
Oleg.
| |