pid namespace isolation broken with powertop

pid namespace isolation broken with powertop

[Daniel Lezcano]

Hi all,

I noticed all the tasks of the host are listed in /proc/timer_stats
These information is not virtualized neither isolated within a container.

I was expecting to see only the tasks in the container with the 
corresponding pids.

I am not sure this is something critical, but the usage of powertop in 
the container shows all the tasks of the system.

While looking at the code in kernel/time/timer.c, it is not obvious to 
fix this isolation because it is the pid number which is stored in a 
list, so there is not enough informations to discriminate the pid 
namespace against the current one.

I am wondering if:

  1) is it worth to isolate these informations ? (IMHO, yes).
  2) should the stats be stored per pid namespace or adding an hash 
value + pid namespace as a key in the timer stats list ?

Thanks
   -- Daniel

Re: pid namespace isolation broken with powertop

[Nathan Lynch]

On Thu, 2010-07-29 at 14:30 +0200, Daniel Lezcano wrote:
> Hi all,
> 
> I noticed all the tasks of the host are listed in /proc/timer_stats
> These information is not virtualized neither isolated within a container.
> 
> I was expecting to see only the tasks in the container with the 
> corresponding pids.
> 
> I am not sure this is something critical, but the usage of powertop in 
> the container shows all the tasks of the system.
> 
> While looking at the code in kernel/time/timer.c, it is not obvious to 
> fix this isolation because it is the pid number which is stored in a 
> list, so there is not enough informations to discriminate the pid 
> namespace against the current one.
> 
> I am wondering if:
> 
>   1) is it worth to isolate these informations ? (IMHO, yes).
>   2) should the stats be stored per pid namespace or adding an hash 
> value + pid namespace as a key in the timer stats list ?

Well, powertop is used for monitoring and modifying global system
characteristics (e.g. processor C states, USB autosuspend) that don't
make sense to virtualize.  Many events in /proc/timer_stats are
accocunted to pid 0 (swapper/idle).  I think the question is whether a
pidns-relative slice of timer events will be useful or just confusing.

Re: pid namespace isolation broken with powertop

[Daniel Lezcano]

On 07/29/2010 04:35 PM, Nathan Lynch wrote:
> On Thu, 2010-07-29 at 14:30 +0200, Daniel Lezcano wrote:
>    
>> Hi all,
>>
>> I noticed all the tasks of the host are listed in /proc/timer_stats
>> These information is not virtualized neither isolated within a container.
>>
>> I was expecting to see only the tasks in the container with the
>> corresponding pids.
>>
>> I am not sure this is something critical, but the usage of powertop in
>> the container shows all the tasks of the system.
>>
>> While looking at the code in kernel/time/timer.c, it is not obvious to
>> fix this isolation because it is the pid number which is stored in a
>> list, so there is not enough informations to discriminate the pid
>> namespace against the current one.
>>
>> I am wondering if:
>>
>>    1) is it worth to isolate these informations ? (IMHO, yes).
>>    2) should the stats be stored per pid namespace or adding an hash
>> value + pid namespace as a key in the timer stats list ?
>>      
> Well, powertop is used for monitoring and modifying global system
> characteristics (e.g. processor C states, USB autosuspend) that don't
> make sense to virtualize.  Many events in /proc/timer_stats are
> accocunted to pid 0 (swapper/idle).  I think the question is whether a
> pidns-relative slice of timer events will be useful or just confusing.
>    

IMHO I find confusing to see all the applications name/pid running on 
the whole system (host + containers) from a container. Even if these 
applications are not accessible, that gives informations to the 
container on what is running on the system and I think we should 
consider that as a security breach.

We can just "hide" the content of this file for a pid namespace 
different of the init pid namespace, but that may suppress the 
possibility to investigate with powertop the consumption of a specific 
appliance, as accurate as it could be...

Thanks
   -- Daniel

Re: pid namespace isolation broken with powertop

[Marc Aymerich]

On Thu, Jul 29, 2010 at 5:22 PM, Daniel Lezcano <daniel.lezcano-GANU6spQydw@public.gmane.org>wrote:

> On 07/29/2010 04:35 PM, Nathan Lynch wrote:
> > On Thu, 2010-07-29 at 14:30 +0200, Daniel Lezcano wrote:
> >
> >> Hi all,
> >>
> >> I noticed all the tasks of the host are listed in /proc/timer_stats
> >> These information is not virtualized neither isolated within a
> container.
> >>
> >> I was expecting to see only the tasks in the container with the
> >> corresponding pids.
> >>
> >> I am not sure this is something critical, but the usage of powertop in
> >> the container shows all the tasks of the system.
> >>
> >> While looking at the code in kernel/time/timer.c, it is not obvious to
> >> fix this isolation because it is the pid number which is stored in a
> >> list, so there is not enough informations to discriminate the pid
> >> namespace against the current one.
> >>
> >> I am wondering if:
> >>
> >>    1) is it worth to isolate these informations ? (IMHO, yes).
> >>    2) should the stats be stored per pid namespace or adding an hash
> >> value + pid namespace as a key in the timer stats list ?
> >>
> > Well, powertop is used for monitoring and modifying global system
> > characteristics (e.g. processor C states, USB autosuspend) that don't
> > make sense to virtualize.  Many events in /proc/timer_stats are
> > accocunted to pid 0 (swapper/idle).  I think the question is whether a
> > pidns-relative slice of timer events will be useful or just confusing.
> >
>
> IMHO I find confusing to see all the applications name/pid running on
> the whole system (host + containers) from a container. Even if these
> applications are not accessible, that gives informations to the
> container on what is running on the system and I think we should
> consider that as a security breach.
>
> We can just "hide" the content of this file for a pid namespace
> different of the init pid namespace, but that may suppress the
> possibility to investigate with powertop the consumption of a specific
> appliance, as accurate as it could be...
>


Hi Daniel, I wouldn't worry too much about powertop

http://www.phoronix.com/scan.php?page=article&item=powertop_2010_test&num=1

br.

-- 
Marc