Re: CLONE_NEWIPC documentation

[Michael Kerrisk <mtk-manpages@gmx.net>]

Eric W. Biederman wrote:
> Michael Kerrisk <mtk-manpages@gmx.net> writes:
> 
>> Hello Kirill,
>>
>> In 2.6.19, your patch to add support for CLONE_NEWIPC was included.  Is
>> there there some for-userland-programmers documentation of this flag
>> somewhere?  Would you be able to send some documentation to me (ideally as
>> a patch to the clone.2 man page, but otherwise some plain text will do).
>>
>> If this flag is also supported for unshare(), then could you please send me
>> a patch/text for that too?
> 
> In case someone else doesn't do better here is a short summary.

Thanks Eric.  That looks to cover a lot of the essentials.  Anyone else see
something important that should be documented?

And a further question: is CLONE_NEWIPC implemented for unshare()?

Cheers,

Michael


> CLONE_NEWIPC creates a new ipc namespace for the new child and all
> of it's children.  So far CAP_SYS_ADMIN is required.
> 
> An IPC namespace creates a new context for looking up and listing
> SYSV IPC shared memory, message queues, and semaphores.  Only allowing
> finding of SYSV IPC objects in this namespace.
> 
> For most practical purposes two processes in different SYSV IPC
> namespaces might as well be on different machines.  As they cannot
> find each others SYSV IPC resources, and so cannot interact with
> each other that way.
> 
> The implementation is essentially just a lookup of the objects
> in a different table when doing name to object translation so
> there should be no measurable overhead.
> 
> When the last process in a SYSV IPC namespace exits any remaining
> objects in that SYSV IPC namespace are destroyed.
> 
> Eric
> 

-- 
Michael Kerrisk
maintainer of Linux man pages Sections 2, 3, 4, 5, and 7

Want to help with man page maintenance?  Grab the latest tarball at
http://www.kernel.org/pub/linux/docs/manpages/
read the HOWTOHELP file and grep the source files for 'FIXME'.