From mboxrd@z Thu Jan 1 00:00:00 1970 From: Rob Landley Subject: Re: For review: pid_namespaces(7) man page Date: Thu, 28 Feb 2013 22:01:44 -0600 Message-ID: <1362110504.15531.4@driftwood> References: Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8"; Format="Flowed"; DelSp="Yes" Content-Transfer-Encoding: base64 Return-path: In-Reply-To: (from mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org on Thu Feb 28 05:24:07 2013) Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org Cc: linux-man , Linux Containers , "Eric W. Biederman" , lkml List-Id: containers.vger.kernel.org T24gMDIvMjgvMjAxMyAwNToyNDowNyBBTSwgTWljaGFlbCBLZXJyaXNrIChtYW4tcGFnZXMpIHdy b3RlOgo+IEVyaWMgZXQgYWwsCj4gCj4gRXZlbnR1YWxseSwgdGhlcmUgd2lsbCBiZSBtb3JlIG5h bWVzcGFjZSBtYW4gcGFnZXMsIGJ1dCBsZXQgdXMgc3RhcnQKPiBub3cgd2l0aCBvbmUgZm9yIFBJ RCBuYW1lc3BhY2VzLiBUaGUgYXR0YWNoZWQgcGFnZSBhaW1zIHRvIHByb3ZpZGUgYQo+IGZhaXJs eSBjb21wbGV0ZSBvdmVydmlldyBvZiBQSUQgbmFtZXNwYWNlcy4KCk9ud2FyZCEKCj4gUElEX05B TUVTUEFDRVMoNykgICAgICBMaW51eCBQcm9ncmFtbWVyJ3MgTWFudWFsICAgICBQSURfTkFNRVNQ QUNFUyg3KQo+IAo+IE5BTUUKPiAgICAgICAgcGlkX25hbWVzcGFjZXMgLSBvdmVydmlldyBvZiBM aW51eCBQSUQgbmFtZXNwYWNlcwo+IAo+IERFU0NSSVBUSU9OCj4gICAgICAgIEZvciBhbiBvdmVy dmlldyBvZiBuYW1lc3BhY2VzLCBzZWUgbmFtZXNwYWNlcyg3KS4KPiAKPiAgICAgICAgUElEICBu YW1lc3BhY2VzICBpc29sYXRlICB0aGUgIHByb2Nlc3MgSUQgbnVtYmVyIHNwYWNlLCBtZWFuaW5n Cj4gICAgICAgIHRoYXQgcHJvY2Vzc2VzIGluIGRpZmZlcmVudCBQSUQgbmFtZXNwYWNlcyBjYW4g IGhhdmUgIHRoZSAgc2FtZQo+ICAgICAgICBQSUQuCgpVbSwgcGVyaGFwcyAiZGlmZmVyZW50IHBy b2Nlc3NlcyI/IFNsaWdodGx5IHJlcGV0aXRpdmUsIGJ1dCB0cnlpbmcgdG8gIAphdm9pZCB0aGUg cG90ZW50aWFsIG1pc3JlYWRpbmcgdGhhdCAiYSBwcm9jZXNzZXMgY2FuIGhhdmUgdGhlIHNhbWUg UElEICAKaW4gZGlmZmVyZW50IG5hbWVzcGFjZXMiLiAoQSBzaW5nbGUgcHJvY2VzcyBjYW4ndCBi ZSBhIG1lbWJlciBvZiBtb3JlICAKdGhhbiBvbmUgbmFtZXNwYWNlLiBUaGlzIGlzIG5vdCBhYm91 dCBzZWxlY3RpdmUgdmlzaWJpbGl0eS4pCgo+IFBJRCBuYW1lc3BhY2VzIGFsbG93IGNvbnRhaW5l cnMgdG8gbWlncmF0ZSB0byBhIG5ldyBob3N0Cj4gICAgICAgIHdoaWxlIHRoZSBwcm9jZXNzZXMg aW5zaWRlICB0aGUgIGNvbnRhaW5lciAgbWFpbnRhaW4gIHRoZSAgc2FtZQo+ICAgICAgICBQSURz LgoKSSB0aG91Z2h0IHN1c3BlbmQvcmVzdW1lIGEgY29udGFpbmVyIHdhcyB0aGUgc2ltcGxlIGNh c2UuIE1pZ3JhdGlvbiB0byAgCmEgbmV3IGhvc3QgaXMgYnVpbHQgb24gdG9wIG9mIHRoYXQuIChP biByZXN1bWUgaW4gYSBuZXcgY29udGFpbmVyIG9uICAKdGhlIHNhbWUgc3lzdGVtLCBpZiBvdGhl ciBzdHVmZiBpcyBnb2luZyBvbiBpbiB0aGUgc3lzdGVtIHNvIHRoZSAgCmF2YWlsYWJsZSBQSURz IGhhdmUgc2hpZnRlZC4pCgo+ICAgICAgICBMaWtld2lzZSwgYSBwcm9jZXNzIGluIGFuIGFuY2Vz dG9yIG5hbWVzcGFjZSBjYW7igJRzdWJqZWN0IHRvIHRoZQo+ICAgICAgICB1c3VhbCBwZXJtaXNz aW9uIGNoZWNrcyBkZXNjcmliZWQgaW4gIGtpbGwoMinigJRzZW5kICBzaWduYWxzICB0bwo+ICAg ICAgICB0aGUgICJpbml0IiBwcm9jZXNzIG9mIGEgY2hpbGQgUElEIG5hbWVzcGFjZSBvbmx5IGlm IHRoZSAiaW5pdCIKPiAgICAgICAgcHJvY2VzcyBoYXMgZXN0YWJsaXNoZWQgYSBoYW5kbGVyIGZv ciB0aGF0IHNpZ25hbC4gIChXaXRoaW4gdGhlCj4gICAgICAgIGhhbmRsZXIsICB0aGUgIHNpZ2lu Zm9fdCBzaV9waWQgZmllbGQgZGVzY3JpYmVkIGluIHNpZ2FjdGlvbigyKQo+ICAgICAgICB3aWxs IGJlIHplcm8uKSAgU0lHS0lMTCBvciBTSUdTVE9QIGFyZSAgdHJlYXRlZCAgZXhjZXB0aW9uYWxs eToKPiAgICAgICAgdGhlc2Ugc2lnbmFscyBhcmUgZm9yY2libHkgZGVsaXZlcmVkIHdoZW4gc2Vu dCBmcm9tIGFuIGFuY2VzdG9yCj4gICAgICAgIFBJRCBuYW1lc3BhY2UuICBOZWl0aGVyIG9mIHRo ZXNlIHNpZ25hbHMgY2FuIGJlIGNhdWdodCAgYnkgIHRoZQo+ICAgICAgICAiaW5pdCIgcHJvY2Vz cywgYW5kIHNvIHdpbGwgcmVzdWx0IGluIHRoZSB1c3VhbCBhY3Rpb25zIGFzc29jaeKAkAo+ICAg ICAgICBhdGVkIHdpdGggdGhvc2Ugc2lnbmFscyAocmVzcGVjdGl2ZWx5LCB0ZXJtaW5hdGluZyBh bmQgc3RvcHBpbmcKPiAgICAgICAgdGhlIHByb2Nlc3MpLgoKSWYgU0lHS0lMTCB0byBpbml0IGlz IHByb3BvZ2F0ZWQgdG8gYWxsIHRoZSBjaGlsZHJlbiBvZiBpbml0LCBpcyAgClNJR1NUT1AgYWxz byBwcm9wb2dhdGVkIHRvIGFsbCB0aGUgY2hpbGRyZW4/IChJLkUuIHdpbGwgU0lHU1RPUCB0byAg CmNvbnRhaW5lcidzIGluaXQgc3VzcGVuZCB0aGUgd2hvbGUgY29udGFpbmVyLCBhbmQgd2lsbCBT SUdDT05UIHJlc3VtZSAgCnRoZSB3aG9sZSBjb250YWluZXI/IElmIHRoZSBsYXR0ZXIsIHdpbGwg aXQgb25seSByZXN1bWUgcHJvY2Vzc2VzIHRoYXQgIAp3ZXJlbid0IHByZXZpb3VzbHkgc3RvcHBl ZD8gOikKCj4gICAgICAgIFRvIHB1dCB0aGluZ3MgYW5vdGhlciB3YXk6IGEgcHJvY2VzcydzIFBJ RCBuYW1lc3BhY2UgbWVtYmVyc2hpcAo+ICAgICAgICBpcyBkZXRlcm1pbmVkIHdoZW4gdGhlIHBy b2Nlc3MgaXMgY3JlYXRlZCBhbmQgY2Fubm90IGJlIGNoYW5nZWQKPiAgICAgICAgdGhlcmVhZnRl ci4gIEFtb25nIG90aGVyIHRoaW5ncywgdGhpcyBtZWFucyB0aGF0ICB0aGUgIHBhcmVudGFsCj4g ICAgICAgIHJlbGF0aW9uc2hpcCBiZXR3ZWVuIHByb2Nlc3NlcyBtaXJyb3JzIHRoZSBwYXJlbnRh bCBiZXR3ZWVuIFBJRAoKbWlycm9ycyB0aGUgcmVsYXRpb25zaGlwCgo+ICAgICAgICBuYW1lc3Bh Y2VzOiB0aGUgcGFyZW50IG9mIGEgIHByb2Nlc3MgIGlzICBlaXRoZXIgIGluICB0aGUgIHNhbWUK PiAgICAgICAgbmFtZXNwYWNlIG9yIHJlc2lkZXMgaW4gdGhlIGltbWVkaWF0ZSBwYXJlbnQgUElE IG5hbWVzcGFjZS4KPiAKPiAgICAgICAgRXZlcnkgIHRocmVhZCAgaW4gIGEgcHJvY2VzcyBtdXN0 IGJlIGluIHRoZSBzYW1lIFBJRCBuYW1lc3BhY2UuCj4gICAgICAgIEZvciB0aGlzIHJlYXNvbiwg dGhlIHR3byBmb2xsb3dpbmcgY2FsbCBzZXF1ZW5jZXMgd2lsbCBmYWlsOgo+IAo+ICAgICAgICAg ICAgdW5zaGFyZShDTE9ORV9ORVdQSUQpOwo+ICAgICAgICAgICAgY2xvbmUoLi4uLCBDTE9ORV9W TSwgLi4uKTsgICAgLyogRmFpbHMgKi8KPiAKPiAgICAgICAgICAgIHNldG5zKGZkLCBDTE9ORV9O RVdQSUQpOwo+ICAgICAgICAgICAgY2xvbmUoLi4uLCBDTE9ORV9WTSwgLi4uKTsgICAgLyogRmFp bHMgKi8KClRoZXkgZmFpbCB3aXRoIC1FVU5ET0NVTUVOVEVECgo+ICAgICAgICBCZWNhdXNlIHRo ZSBhYm92ZSB1bnNoYXJlKDIpIGFuZCBzZXRucygyKSBjYWxscyBvbmx5IGNoYW5nZSB0aGUKPiAg ICAgICAgUElEICBuYW1lc3BhY2UgIGZvciBjcmVhdGVkIGNoaWxkcmVuLCB0aGUgY2xvbmUoMikg Y2FsbHMgbmVjZXPigJAKPiAgICAgICAgc2FyaWx5IHB1dCB0aGUgbmV3IHRocmVhZCBpbiBhIGRp ZmZlcmVudCBQSUQgbmFtZXNwYWNlIGZyb20gdGhlCj4gICAgICAgIGNhbGxpbmcgdGhyZWFkLgoK VW0sIG5vIHRoZXkgZG9uJ3QuIFRoZXkgZmFpbC4gVGhhdCdzIHRoZSBwb2ludC4gVGhleSBfd291 bGRfIHB1dCB0aGUgIApuZXcgdGhyZWFkIGluIGEgZGlmZmVyZW50IFBJRCBuYW1lc3BhY2UsIHdo aWNoIGJyZWFrcyB0aGUgZGVmaW5pdGlvbiBvZiAgCnRocmVhZHMuCgpIb3cgYWJvdXQ6CgpUaGUg YWJvdmUgdW5zaGFyZSgyKSBhbmQgc2V0bnMoMikgY2FsbHMgY2hhbmdlIHRoZSBQSUQgbmFtZXNw YWNlIG9mCmNoaWxkcmVuIGNyZWF0ZWQgYnkgc3Vic2VxdWVudCBjbG9uZSgyKSBjYWxscywgd2hp Y2ggaXMgaW5jb21wYXRpYmxlCndpdGggQ0xPTkVfVk0uCgo+ICAgIE1pc2NlbGxhbmVvdXMKPiAg ICAgICAgQWZ0ZXIgIGNyZWF0aW5nIGEgbmV3IFBJRCBuYW1lc3BhY2UsIGl0IGlzIHVzZWZ1bCBm b3IgdGhlIGNoaWxkCj4gICAgICAgIHRvIGNoYW5nZSBpdHMgcm9vdCBkaXJlY3RvcnkgYW5kIG1v dW50IGEgbmV3IHByb2NmcyBpbnN0YW5jZSBhdAo+ICAgICAgICAvcHJvYyAgc28gIHRoYXQgIHRv b2xzIHN1Y2ggYXMgcHMoMSkgd29yayBjb3JyZWN0bHkuICAoSWYgYSBuZXcKPiAgICAgICAgbW91 bnQgIG5hbWVzcGFjZSAgaXMgIHNpbXVsdGFuZW91c2x5ICAgY3JlYXRlZCAgIGJ5ICAgaW5jbHVk aW5nCj4gICAgICAgIENMT05FX05FV05TICBpbiAgdGhlIGZsYWdzIGFyZ3VtZW50IG9mIGNsb25l KDIpIG9yIHVuc2hhcmUoMikpLAo+ICAgICAgICB0aGVuIGl0IGlzbid0IG5lY2Vzc2FyeSB0byBj aGFuZ2UgdGhlICByb290ICBkaXJlY3Rvcnk6ICBhICBuZXcKPiAgICAgICAgcHJvY2ZzIGluc3Rh bmNlIGNhbiBiZSBtb3VudGVkIGRpcmVjdGx5IG92ZXIgL3Byb2MuKQoKV2h5IGlzIHRoZSAoSWYp IGNsYXVzZSBpbiBwYXJlbnRoZXNlcz8gQW5kIHVuc2hhcmUoMikpIGhhcyBhIEJydWNlLgooSS5F LiB1bmJhbGFuY2VkIHBhcmVucy4pLgoKPiAgICAgICAgQ2FsbGluZyAgcmVhZGxpbmsoMikgIG9u IHRoZSBwYXRoIC9wcm9jL3NlbGYgeWllbGRzIHRoZSBwcm9jZXNzCj4gICAgICAgIElEIG9mIHRo ZSBjYWxsZXIgaW4gdGhlICBQSUQgIG5hbWVzcGFjZSAgb2YgIHRoZSAgcHJvY2ZzICBtb3VudAo+ ICAgICAgICAoaS5lLiwgIHRoZSAgUElEICBuYW1lc3BhY2UgIG9mICB0aGUgIHByb2Nlc3MgIHRo YXQgbW91bnRlZCB0aGUKPiAgICAgICAgcHJvY2ZzKS4KClRoaXMgaXMgcGVyLWZpbGVzeXN0ZW0g cmF0aGVyIHRoYW4gdXNpbmcgdGhlIHByb2Nlc3MncyBuYW1lc3BhY2UgIApiZWNhdXNlLi4uPwoo V2hlcmUgL3Byb2Mvc2VsZiBwb2ludHMgaXMgYWxyZWFkeSBwcm9jZXNzLWxvY2FsIGRhdGEsIHNv IHRoZSByYWNlcyAgCmhlcmUgY2FuJ3QgYmUgdG9vIGhvcnJpYmxlLi4uKQoKPiAgICAgICAgV2hl biBhIHByb2Nlc3MgSUQgaXMgcGFzc2VkIG92ZXIgYSAgVU5JWCAgZG9tYWluICBzb2NrZXQgIHRv ICBhCj4gICAgICAgIHByb2Nlc3MgIGluICBhICBkaWZmZXJlbnQgUElEIG5hbWVzcGFjZSAoc2Vl IHRoZSBkZXNjcmlwdGlvbiBvZgo+ICAgICAgICBTQ01fQ1JFREVOVElBTFMgaW4gdW5peCg3KSks IGl0IGlzIHRyYW5zbGF0ZWQgaW50byAgdGhlICBjb3JyZeKAkAo+ICAgICAgICBzcG9uZGluZyBQ SUQgdmFsdWUgaW4gdGhlIHJlY2VpdmluZyBwcm9jZXNzJ3MgUElEIG5hbWVzcGFjZS4KCkhlaC4g OikKCj4gQ09ORk9STUlORyBUTwo+ICAgICAgICBOYW1lc3BhY2VzIGFyZSBhIExpbnV4LXNwZWNp ZmljIGZlYXR1cmUuCgpBbmQgeWV0IHRoZSBnbGliYyBndXlzIGluc2lzdCBvbiAjZGVmaW5lIEdO VV9HTlVfR05VX0FMTF9IQUlMX1NUQUxMTUFOICAKaW4gb3JkZXIgdG8gYWNjZXNzIHRoaXMgTGlu dXgtc3BlY2lmaWMgZmVhdHVyZSB3aGljaCBoYXMgbm90aGluZyAgCndoYXRzb2V2ZXIgdG8gZG8g d2l0aCB0aGUgRlNGLgoKVGhlIHVuc2hhcmUoKSBjYWxsIG9yaWdpbmFsbHkgX2RpZG4ndF8gcmVx dWlyZSB0aGlzIGRlZmluZSwgYnV0IHRoZXkgIApyZXRyb2FjdGl2ZWx5IGFkZGVkIHRoZSByZXF1 aXJlbWVudCBpbiBhIHZlcnNpb24gInVwZ3JhZGUiIHRvIG1hdGNoICAKeW91ciBtYW4gcGFnZS4g VGhpcyBtYWRlIG1lIHNhZC4gSXQgYWxzbyBtYWRlIG1lIHByb3RvdHlwZSBpdCBteXNlbGYgIApy YXRoZXIgdGhhbiBleHBlY3RpbmcgdGhlIGhlYWRlciB0byBwcm92aWRlIGl0LgoKUm9iCl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCkNvbnRhaW5lcnMgbWFp bGluZyBsaXN0CkNvbnRhaW5lcnNAbGlzdHMubGludXgtZm91bmRhdGlvbi5vcmcKaHR0cHM6Ly9s aXN0cy5saW51eGZvdW5kYXRpb24ub3JnL21haWxtYW4vbGlzdGluZm8vY29udGFpbmVycw== From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751926Ab3CAFH7 (ORCPT ); Fri, 1 Mar 2013 00:07:59 -0500 Received: from mail-ie0-f173.google.com ([209.85.223.173]:37973 "EHLO mail-ie0-f173.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751847Ab3CAFH5 convert rfc822-to-8bit (ORCPT ); Fri, 1 Mar 2013 00:07:57 -0500 Date: Thu, 28 Feb 2013 22:01:44 -0600 From: Rob Landley Subject: Re: For review: pid_namespaces(7) man page To: mtk.manpages@gmail.com Cc: "Eric W. Biederman" , linux-man , Linux Containers , lkml References: In-Reply-To: (from mtk.manpages@gmail.com on Thu Feb 28 05:24:07 2013) X-Mailer: Balsa 2.4.11 Message-Id: <1362110504.15531.4@driftwood> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; DelSp=Yes; Format=Flowed Content-Disposition: inline Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 02/28/2013 05:24:07 AM, Michael Kerrisk (man-pages) wrote: > Eric et al, > > Eventually, there will be more namespace man pages, but let us start > now with one for PID namespaces. The attached page aims to provide a > fairly complete overview of PID namespaces. Onward! > PID_NAMESPACES(7) Linux Programmer's Manual PID_NAMESPACES(7) > > NAME > pid_namespaces - overview of Linux PID namespaces > > DESCRIPTION > For an overview of namespaces, see namespaces(7). > > PID namespaces isolate the process ID number space, meaning > that processes in different PID namespaces can have the same > PID. Um, perhaps "different processes"? Slightly repetitive, but trying to avoid the potential misreading that "a processes can have the same PID in different namespaces". (A single process can't be a member of more than one namespace. This is not about selective visibility.) > PID namespaces allow containers to migrate to a new host > while the processes inside the container maintain the same > PIDs. I thought suspend/resume a container was the simple case. Migration to a new host is built on top of that. (On resume in a new container on the same system, if other stuff is going on in the system so the available PIDs have shifted.) > Likewise, a process in an ancestor namespace can—subject to the > usual permission checks described in kill(2)—send signals to > the "init" process of a child PID namespace only if the "init" > process has established a handler for that signal. (Within the > handler, the siginfo_t si_pid field described in sigaction(2) > will be zero.) SIGKILL or SIGSTOP are treated exceptionally: > these signals are forcibly delivered when sent from an ancestor > PID namespace. Neither of these signals can be caught by the > "init" process, and so will result in the usual actions associ‐ > ated with those signals (respectively, terminating and stopping > the process). If SIGKILL to init is propogated to all the children of init, is SIGSTOP also propogated to all the children? (I.E. will SIGSTOP to container's init suspend the whole container, and will SIGCONT resume the whole container? If the latter, will it only resume processes that weren't previously stopped? :) > To put things another way: a process's PID namespace membership > is determined when the process is created and cannot be changed > thereafter. Among other things, this means that the parental > relationship between processes mirrors the parental between PID mirrors the relationship > namespaces: the parent of a process is either in the same > namespace or resides in the immediate parent PID namespace. > > Every thread in a process must be in the same PID namespace. > For this reason, the two following call sequences will fail: > > unshare(CLONE_NEWPID); > clone(..., CLONE_VM, ...); /* Fails */ > > setns(fd, CLONE_NEWPID); > clone(..., CLONE_VM, ...); /* Fails */ They fail with -EUNDOCUMENTED > Because the above unshare(2) and setns(2) calls only change the > PID namespace for created children, the clone(2) calls neces‐ > sarily put the new thread in a different PID namespace from the > calling thread. Um, no they don't. They fail. That's the point. They _would_ put the new thread in a different PID namespace, which breaks the definition of threads. How about: The above unshare(2) and setns(2) calls change the PID namespace of children created by subsequent clone(2) calls, which is incompatible with CLONE_VM. > Miscellaneous > After creating a new PID namespace, it is useful for the child > to change its root directory and mount a new procfs instance at > /proc so that tools such as ps(1) work correctly. (If a new > mount namespace is simultaneously created by including > CLONE_NEWNS in the flags argument of clone(2) or unshare(2)), > then it isn't necessary to change the root directory: a new > procfs instance can be mounted directly over /proc.) Why is the (If) clause in parentheses? And unshare(2)) has a Bruce. (I.E. unbalanced parens.). > Calling readlink(2) on the path /proc/self yields the process > ID of the caller in the PID namespace of the procfs mount > (i.e., the PID namespace of the process that mounted the > procfs). This is per-filesystem rather than using the process's namespace because...? (Where /proc/self points is already process-local data, so the races here can't be too horrible...) > When a process ID is passed over a UNIX domain socket to a > process in a different PID namespace (see the description of > SCM_CREDENTIALS in unix(7)), it is translated into the corre‐ > sponding PID value in the receiving process's PID namespace. Heh. :) > CONFORMING TO > Namespaces are a Linux-specific feature. And yet the glibc guys insist on #define GNU_GNU_GNU_ALL_HAIL_STALLMAN in order to access this Linux-specific feature which has nothing whatsoever to do with the FSF. The unshare() call originally _didn't_ require this define, but they retroactively added the requirement in a version "upgrade" to match your man page. This made me sad. It also made me prototype it myself rather than expecting the header to provide it. Rob