lkml.org 
[lkml]   [2016]   [Aug]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH 0/5 RFC] Add an interface to discover relationships between namespaces
    Hi,

    On 14 July 2016 at 20:20, Andrey Vagin <avagin@openvz.org> wrote:
    > Each namespace has an owning user namespace and now there is not way
    > to discover these relationships.
    >
    > Pid and user namepaces are hierarchical. There is no way to discover
    > parent-child relationships too.
    >
    > Why we may want to know relationships between namespaces?
    >
    > One use would be visualization, in order to understand the running system.

    This looks interesting to me because I am interested in representing
    in a graphical way the relationship between different mounts in
    different mount namespaces (showing the ID, the parent-children
    relationships, mount peer groups, the master-slave relationships etc),
    specially for containers. The first idea was to take both
    /proc/1/mountinfo and /proc/$OTHER_PID/mountinfo and I can correlate
    the "shared:" and "master:" fields in the mountinfo files.

    But I cannot read the /proc/$pid/mountinfo of mount namespaces when
    there are no processes in those mount namespaces. For example, if
    those mount namespaces stay alive only because they contain
    "shared&slave" mounts between master mounts and slave mounts that I
    can see in /proc/$pid/mountinfo. Fictional example:

    # mntns 1, mountinfo 1 (visible via /proc/1/mountinfo)
    61 0 253:1 / / rw shared:1

    # mntns 2, mountinfo 2 (not visible via any /proc/$pid/mountinfo)
    731 569 0:75 / / rw master:1 shared:42

    # mntns 3, mountinfo 3 (not visible via any /proc/${container_pid}/mountinfo)
    762 597 0:82 / / rw master:42 shared:76

    As far as I understand, I cannot get a reference to the mntns2 fd
    because mnt namespaces are not hierarchical, and I cannot get its
    /proc/???/mountinfo because no processes live inside.

    Is there a way around it? Should this use case be handled together?

    Thanks!
    Alban

    > Another would be to answer the question: what capability does process X have to
    > perform operations on a resource governed by namespace Y?
    >
    > One more use-case (which usually called abnormal) is checkpoint/restart.
    > In CRIU we age going to dump and restore nested namespaces.
    >
    > There [1] was a discussion about which interface to choose to determing
    > relationships between namespaces.
    >
    > Eric suggested to add two ioctl-s [2]:
    >> Grumble, Grumble. I think this may actually a case for creating ioctls
    >> for these two cases. Now that random nsfs file descriptors are bind
    >> mountable the original reason for using proc files is not as pressing.
    >>
    >> One ioctl for the user namespace that owns a file descriptor.
    >> One ioctl for the parent namespace of a namespace file descriptor.
    >
    > Here is an implementaions of these ioctl-s.
    >
    > [1] https://lkml.org/lkml/2016/7/6/158
    > [2] https://lkml.org/lkml/2016/7/9/101
    >
    > Cc: "Eric W. Biederman" <ebiederm@xmission.com>
    > Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
    > Cc: "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com>
    > Cc: "W. Trevor King" <wking@tremily.us>
    > Cc: Alexander Viro <viro@zeniv.linux.org.uk>
    > Cc: Serge Hallyn <serge.hallyn@canonical.com>
    >
    > --
    > 2.5.5
    >
    > _______________________________________________
    > Containers mailing list
    > Containers@lists.linux-foundation.org
    > https://lists.linuxfoundation.org/mailman/listinfo/containers

    \
     
     \ /
      Last update: 2016-08-01 21:41    [W:4.847 / U:1.696 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site