All of lore.kernel.org
 help / color / mirror / Atom feed
From: Ian Kent <ikent@redhat.com>
To: Kernel Mailing List <linux-kernel@vger.kernel.org>
Cc: David Howells <dhowells@redhat.com>,
	Oleg Nesterov <onestero@redhat.com>,
	Trond Myklebust <trond.myklebust@primarydata.com>,
	"J. Bruce Fields" <bfields@fieldses.org>,
	Benjamin Coddington <bcodding@redhat.com>,
	Al Viro <viro@ZenIV.linux.org.uk>,
	Jeff Layton <jeff.layton@primarydata.com>,
	"Eric W. Biederman" <ebiederm@xmission.com>
Subject: [RFC PATCH 8/8] nfs - objlayout use namespace if not executing in init namespace
Date: Thu, 05 Feb 2015 10:34:44 +0800	[thread overview]
Message-ID: <20150205023443.8382.68277.stgit@pluto.fritz.box> (raw)
In-Reply-To: <20150205021553.8382.16297.stgit@pluto.fritz.box>

If the caller is running within a container then execute the usermode
helper callback within the init namespace of the container.

Signed-off-by: Ian Kent <ikent@redhat.com>
Cc: Benjamin Coddington <bcodding@redhat.com>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Cc: J. Bruce Fields <bfields@fieldses.org>
Cc: David Howells <dhowells@redhat.com>
Cc: Trond Myklebust <trond.myklebust@primarydata.com>
Cc: Oleg Nesterov <onestero@redhat.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Jeff Layton <jeff.layton@primarydata.com>
---
 fs/nfs/objlayout/objlayout.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/nfs/objlayout/objlayout.c b/fs/nfs/objlayout/objlayout.c
index 919efd4..dd5b9e8 100644
--- a/fs/nfs/objlayout/objlayout.c
+++ b/fs/nfs/objlayout/objlayout.c
@@ -600,8 +600,13 @@ static int __objlayout_upcall(struct __auto_login *login)
 		NULL
 	};
 	char *argv[8];
+	int umh_flags = UMH_WAIT_PROC;
 	int ret;
 
+	/* If running within a container use the container namespace */
+	if (current->nsproxy->net_ns != &init_net)
+		umh_flags |= UMH_USE_NS;
+
 	if (unlikely(!osd_login_prog[0])) {
 		dprintk("%s: osd_login_prog is disabled\n", __func__);
 		return -EACCES;
@@ -620,7 +625,7 @@ static int __objlayout_upcall(struct __auto_login *login)
 	argv[6] = login->systemid_hex;
 	argv[7] = NULL;
 
-	ret = call_usermodehelper(argv[0], argv, envp, UMH_WAIT_PROC);
+	ret = call_usermodehelper(argv[0], argv, envp, umh_flags);
 	/*
 	 * Disable the upcall mechanism if we're getting an ENOENT or
 	 * EACCES error. The admin can re-enable it on the fly by using


      parent reply	other threads:[~2015-02-05  2:35 UTC|newest]

Thread overview: 48+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-02-05  2:33 [RFC PATCH 0/8] v3 contained usermode helper execution Ian Kent
2015-02-05  2:33 ` [RFC PATCH 1/8] nsproxy - refactor setns() Ian Kent
2015-02-05  2:34 ` [RFC PATCH 2/8] kmod - rename call_usermodehelper() flags parameter Ian Kent
2015-02-05 15:01   ` David Howells
2015-02-06  0:01     ` Ian Kent
2015-02-05  2:34 ` [RFC PATCH 3/8] kmod - teach call_usermodehelper() to use a namespace Ian Kent
2015-02-05 15:24   ` David Howells
2015-02-06 12:08   ` Jeff Layton
2015-02-08  3:07     ` Ian Kent
2015-02-08 15:22       ` Jeff Layton
2015-02-08 18:12       ` Oleg Nesterov
2015-02-08 19:00   ` Oleg Nesterov
2015-02-09  1:43     ` Ian Kent
2015-02-09 16:03       ` Oleg Nesterov
2015-02-10  0:08         ` Ian Kent
2015-02-10 16:55           ` Oleg Nesterov
2015-02-11  0:40             ` Ian Kent
2015-02-16  6:16             ` Ian Kent
2015-02-16 17:13               ` Oleg Nesterov
2015-02-16 18:24                 ` Oleg Nesterov
2015-02-18  2:09                   ` Ian Kent
2015-02-18  1:42                 ` Ian Kent
2015-02-05  2:34 ` [RFC PATCH 4/8] KEYS - rename call_usermodehelper_keys() flags parameter Ian Kent
2015-02-05  2:34 ` [RFC PATCH 5/8] KEYS: exec request-key within the requesting task's init namespace Ian Kent
2015-02-05 15:14   ` David Howells
2015-02-06  1:47     ` Ian Kent
2015-02-18 17:06       ` J. Bruce Fields
2015-02-18 17:31         ` J. Bruce Fields
2015-02-18 20:59           ` J. Bruce Fields
2015-02-19  0:39             ` Ian Kent
2015-02-19  1:31               ` J. Bruce Fields
2015-02-19  3:18                 ` Ian Kent
2015-02-20  9:33                 ` Ian Kent
2015-02-20 17:25                   ` J. Bruce Fields
2015-02-20 18:07                     ` Eric W. Biederman
2015-02-20 18:58                       ` Jeff Layton
2015-02-20 19:05                       ` J. Bruce Fields
2015-02-21  3:58                         ` Ian Kent
2015-02-23 14:52                           ` J. Bruce Fields
2015-02-24  0:50                             ` Ian Kent
2015-02-24  1:22                               ` Benjamin Coddington
2015-02-24  8:01                                 ` Ian Kent
2015-02-24 15:33                                 ` J. Bruce Fields
2015-02-25  0:41                                   ` Benjamin Coddington
2015-02-05  2:34 ` [RFC PATCH 6/8] nfsd - use namespace if not executing in " Ian Kent
2015-02-18 17:37   ` J. Bruce Fields
2015-02-05  2:34 ` [RFC PATCH 7/8] nfs - cache_lib " Ian Kent
2015-02-05  2:34 ` Ian Kent [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20150205023443.8382.68277.stgit@pluto.fritz.box \
    --to=ikent@redhat.com \
    --cc=bcodding@redhat.com \
    --cc=bfields@fieldses.org \
    --cc=dhowells@redhat.com \
    --cc=ebiederm@xmission.com \
    --cc=jeff.layton@primarydata.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=onestero@redhat.com \
    --cc=trond.myklebust@primarydata.com \
    --cc=viro@ZenIV.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.