From mboxrd@z Thu Jan 1 00:00:00 1970 From: ebiederm@xmission.com (Eric W. Biederman) Subject: Re: [RFC][PATCH] ns: Syscalls for better namespace sharing control. Date: Sat, 27 Feb 2010 01:42:52 -0800 Message-ID: References: <4B4F24AC.70105@trash.net> <4B4F3A50.1050400@trash.net> <1263490403.23480.109.camel@bigi> <4B50403A.6010507@trash.net> <1263568754.23480.142.camel@bigi> <1266875729.3673.12.camel@bigi> <1266931623.3973.643.camel@bigi> <1266934817.3973.654.camel@bigi> <1266966581.3973.675.camel@bigi> <4B883987.6090408@parallels.com> <4B883E6F.1060907@parallels.com> <4B88D80A.8010701@parallels.com> <4B88E431.6040609@parallels.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: hadi@cyberus.ca, Daniel Lezcano , Patrick McHardy , Linux Netdev List , containers@lists.linux-foundation.org, Netfilter Development Mailinglist , Ben Greear , Serge Hallyn , Matt Helsley To: Pavel Emelyanov Return-path: Received: from out02.mta.xmission.com ([166.70.13.232]:42690 "EHLO out02.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S968061Ab0B0JnD (ORCPT ); Sat, 27 Feb 2010 04:43:03 -0500 In-Reply-To: <4B88E431.6040609@parallels.com> (Pavel Emelyanov's message of "Sat\, 27 Feb 2010 12\:21\:53 +0300") Sender: netfilter-devel-owner@vger.kernel.org List-ID: Pavel Emelyanov writes: > Thanks. What's the problem with setns? joining a preexisting namespace is roughly the same problem as unsharing a namespace. We simply haven't figure out how to do it safely for the pid and the uid namespaces. >> I have designed these file descriptors to pin the namespaces, so >> waiting for them to exit isn't something they can do now. It makes a >> lot of sense to have similar ones that take weak references to the namespaces >> that we can use to wait for a namespace to exit. > > Yes, I saw this from patches. Eric, I'd very much appreciate if we > workout a solution that will allow us to kill two birds with one stone. > I do not want to invent yet another bunch of system calls for "taking > weak reference". Definitely. I only consider the current interface to be a mushy not set in stone. > As a "brain storm" start up. Can we use inotify/dnotify for this? > Or maybe we should better equip the nsfd call with flags argument and > add a flag for weak reference? In that case - how shall we get a > notification about namespace is dead? With poll? Maybe worth making > the sys_close return only when the namespace is dead (by providing a > proper ->release callback of a file)? We would want poll to work, anything else is a weird work-around. The challenging part is that we don't have any infrastructure for notifying when a namespace goes away. So that has to be built before we can wire it up to userspace. I don't expect it is too difficult but there is work to be done. Eric