Re: container sharing /proc/kmsg???

["Serge E. Hallyn" <serue-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>]

Quoting Jean-Marc Pigeon (jmp-4qkeo2rQ0gg@public.gmane.org):
> Hello,
> 
> 
> 	I have done a small utility to build containers
> 	using kernel API 'clone' available with kernel-2.6.31.
> 	So far I am able to run more than 30 different
> 	distribution (from rh7.3 -> fc12) on the same
> 	host.
> 	(ftp://ftp.safe.ca/pub/linux/vzgot to know more.)
> 
> 	Everything is working fine...
> 
> 	Except seems HOST and all containers share the
> 	SAME /proc/kmsg, meaning kernel syslog information
> 	are scrambled (useless).
> 
> 	Namely, I have in iptables, reject packet logging
> 	on the HOST, as soon rsyslog is started on one
> 	container, I can't see my reject packet log anymore. 
> 
> 	Also, container have their own iptables with reject
> 	packet logging which are not displayed too.
> 
> 	Am I wrong/forgetting something about the /proc/kmsg
> 	sharing?
> 
> 	If I am right, should ALL /proc/kmsg be isolated from
> 	each other???
> 	
> 	How could it be done??

Well, the results of do_syslog() should be containerized.  Kernel
messages (oopses for instance) should always go to the initial
container.  Shouldn't be hard to do, but the question is what do
we tie it to?  User namespace?  Network namespace?  Eric, is this
something you've thought about at all?

I'm tempted to say userns makes the most sense - if you start a new
userns you likely always want private syslog, whereas with netns and
pidns you may not.

-serge