Messages in this thread | | | From | (Eric W. Biederman) | Date | Tue, 05 Jan 2016 01:58:34 -0600 | Subject | Re: [Propose] Isolate core_pattern in mnt namespace. |
| |
Dongsheng Yang <yangds.fnst@cn.fujitsu.com> writes:
> On 12/24/2015 12:36 AM, Eric W. Biederman wrote: >> Dongsheng Yang <yangds.fnst@cn.fujitsu.com> writes: > [...] > > Hi Eric, > Happy new year and sorry for the late reply. >> >> Given the other constraints on an implementation the pid namespace looks >> by far the one best suited to host such a sysctl if it is possible to >> implement safely. > > So you think it's better to isolate the core_pattern in pid_namespace, > am I right?
Roughly.
> But, core_file_path and user_mode_helper_path in core_pattern are much > more related with mnt_namespace IMO. > > Could you help to explain it more?
You need a full complement of namespaces, to execute a user mode helper.
Really roughly you need a namespaced equivalent of kthreadd, with a full complement of namespaces and cgroups setup in the container.
Further it is necessary to have a clear rule that says which processes that dump core are affected. For a hierarchical pid namespace this is straight forward. For a mount namespace I don't know how that could be implemented.
And yes the whole kthreadd thing that user mode helper does to launch a task is necessary to have a clean and predicatable environment.
Of course the default rule of dropping a file named core in the current directory of the process that died works for everyone, with no kernel modifications needed.
Eric
| |