linux-api.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Andy Lutomirski <luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org>
To: Richard Guy Briggs <rgb-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
Cc: "Eric W. Biederman"
	<ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>,
	Eric Paris <eparis-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>,
	Steve Grubb <sgrubb-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>,
	arozansk-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org,
	linux-audit-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org,
	Linux API <linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
	Linux Containers
	<containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org>,
	"Serge E. Hallyn" <serge-A9i7LUbDfNHQT0dZR+AlfA@public.gmane.org>,
	"linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org"
	<linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>
Subject: Re: [PATCH V4 1/8] namespaces: assign each namespace instance a serial number
Date: Thu, 21 Aug 2014 14:22:31 -0700	[thread overview]
Message-ID: <CALCETrW+vtPnB47aCxfKFxkmKxZS2QsWCkazCc776yg0aPPidA@mail.gmail.com> (raw)
In-Reply-To: <d5bfd81a219c5c45c910494d6a3478ce83052e1f.1408581429.git.rgb-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>

On Aug 20, 2014 8:12 PM, "Richard Guy Briggs" <rgb-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> wrote:
>
> Generate and assign a serial number per namespace instance since boot.
>
> Use a serial number per namespace (unique across one boot of one kernel)
> instead of the inode number (which is claimed to have had the right to change
> reserved and is not necessarily unique if there is more than one proc fs) to
> uniquely identify it per kernel boot.
>
> Signed-off-by: Richard Guy Briggs <rgb-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> ---
>  fs/mount.h                     |    1 +
>  fs/namespace.c                 |    1 +
>  include/linux/ipc_namespace.h  |    1 +
>  include/linux/nsproxy.h        |    8 ++++++++
>  include/linux/pid_namespace.h  |    1 +
>  include/linux/user_namespace.h |    1 +
>  include/linux/utsname.h        |    1 +
>  include/net/net_namespace.h    |    1 +
>  init/version.c                 |    1 +
>  ipc/msgutil.c                  |    1 +
>  ipc/namespace.c                |    2 ++
>  kernel/nsproxy.c               |   17 +++++++++++++++++
>  kernel/pid.c                   |    1 +
>  kernel/pid_namespace.c         |    2 ++
>  kernel/user.c                  |    1 +
>  kernel/user_namespace.c        |    2 ++
>  kernel/utsname.c               |    2 ++
>  net/core/net_namespace.c       |    8 +++++++-
>  18 files changed, 51 insertions(+), 1 deletions(-)
>
> diff --git a/fs/mount.h b/fs/mount.h
> index d55297f..c076f99 100644
> --- a/fs/mount.h
> +++ b/fs/mount.h
> @@ -5,6 +5,7 @@
>  struct mnt_namespace {
>         atomic_t                count;
>         unsigned int            proc_inum;
> +       long long       serial_num;
>         struct mount *  root;
>         struct list_head        list;
>         struct user_namespace   *user_ns;
> diff --git a/fs/namespace.c b/fs/namespace.c
> index 182bc41..9af49ff 100644
> --- a/fs/namespace.c
> +++ b/fs/namespace.c
> @@ -2486,6 +2486,7 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
>                 kfree(new_ns);
>                 return ERR_PTR(ret);
>         }
> +       new_ns->serial_num = ns_serial();
>         new_ns->seq = atomic64_add_return(1, &mnt_ns_seq);
>         atomic_set(&new_ns->count, 1);
>         new_ns->root = NULL;
> diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h
> index 35e7eca..8ccfb2d 100644
> --- a/include/linux/ipc_namespace.h
> +++ b/include/linux/ipc_namespace.h
> @@ -69,6 +69,7 @@ struct ipc_namespace {
>         struct user_namespace *user_ns;
>
>         unsigned int    proc_inum;
> +       long long       serial_num;
>  };
>
>  extern struct ipc_namespace init_ipc_ns;
> diff --git a/include/linux/nsproxy.h b/include/linux/nsproxy.h
> index b4ec59d..8e5fe0d 100644
> --- a/include/linux/nsproxy.h
> +++ b/include/linux/nsproxy.h
> @@ -66,6 +66,14 @@ static inline struct nsproxy *task_nsproxy(struct task_struct *tsk)
>         return rcu_dereference(tsk->nsproxy);
>  }
>
> +long long ns_serial(void);
> +enum {
> +       NS_IPC_INIT_SN  = 1,
> +       NS_UTS_INIT_SN  = 2,
> +       NS_USER_INIT_SN = 3,
> +       NS_PID_INIT_SN  = 4,

Please add an extra value here for the first dynamic value...
> +/**
> + * ns_serial - compute a serial number for the namespace
> + *
> + * Compute a serial number for the namespace to uniquely identify it in
> + * audit records.
> + */
> +long long ns_serial(void)
> +{
> +       static atomic64_t serial = ATOMIC_INIT(4); /* reserved for IPC, UTS, user, PID */

...and use it here.

Also, does this work on all architectures?


--Andy

  parent reply	other threads:[~2014-08-21 21:22 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-08-21  1:09 [PATCH V4 0/8] namespaces: log namespaces per task Richard Guy Briggs
     [not found] ` <cover.1408581429.git.rgb-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2014-08-21  1:09   ` [PATCH V4 1/8] namespaces: assign each namespace instance a serial number Richard Guy Briggs
     [not found]     ` <d5bfd81a219c5c45c910494d6a3478ce83052e1f.1408581429.git.rgb-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2014-08-21 21:22       ` Andy Lutomirski [this message]
     [not found]         ` <CALCETrW+vtPnB47aCxfKFxkmKxZS2QsWCkazCc776yg0aPPidA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2014-08-21 21:28           ` Richard Guy Briggs
     [not found]             ` <20140821212820.GD20529-bcJWsdo4jJjeVoXN4CMphl7TgLCtbB0G@public.gmane.org>
2014-08-21 21:30               ` Andy Lutomirski
     [not found]                 ` <CALCETrXUTTo5MN=bRM96Kos5JueWED5Rhr7SB2dgzTdy7bw5cw-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2014-08-21 22:15                   ` Richard Guy Briggs
2014-08-23 12:05       ` Eric W. Biederman
     [not found]         ` <87ioljs968.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org>
2014-08-24 20:38           ` Richard Guy Briggs
     [not found]             ` <20140824203827.GI9003-bcJWsdo4jJjeVoXN4CMphl7TgLCtbB0G@public.gmane.org>
2014-08-28 20:05               ` Eric W. Biederman
     [not found]                 ` <87tx4wmlcj.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org>
2014-09-02 21:40                   ` Richard Guy Briggs
2014-08-21  1:09   ` [PATCH V4 2/8] namespaces: expose namespace instance serial number in proc_ns_operations Richard Guy Briggs
2014-08-21  1:09   ` [PATCH V4 3/8] namespaces: expose ns instance serial numbers in proc Richard Guy Briggs
     [not found]     ` <cd6cd0622ce677b639afae18a69ff79c72490bab.1408581429.git.rgb-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2014-08-21 21:13       ` Andy Lutomirski
     [not found]         ` <CALCETrUnzG1V8w+H9ctAJP+Hvo8LQax=dhLG4bBpBKmVi+C1cQ-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2014-08-22  1:58           ` Richard Guy Briggs
     [not found]             ` <20140822015803.GG20529-bcJWsdo4jJjeVoXN4CMphl7TgLCtbB0G@public.gmane.org>
2014-08-24 17:52               ` Andy Lutomirski
     [not found]                 ` <CALCETrUkFD0iNi1SV_6ypN5Kf4GYybT5tzjRjRQuLzT9iBnQAg-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2014-08-24 20:28                   ` Richard Guy Briggs
2014-08-25 13:30                   ` Nicolas Dichtel
     [not found]                     ` <53FB3A86.2060203-pdR9zngts4EAvxtiuMwx3w@public.gmane.org>
2014-08-25 14:04                       ` Andy Lutomirski
     [not found]                         ` <CALCETrW1Lv0qeccMjNHSEzgtiaNN3NgJVR1dFjjR_dw5KVVnqA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2014-08-25 15:43                           ` Nicolas Dichtel
     [not found]                             ` <53FB59A3.5030804-pdR9zngts4EAvxtiuMwx3w@public.gmane.org>
2014-08-25 16:13                               ` Andy Lutomirski
     [not found]                                 ` <CALCETrWHrWhm89B5s=pLt_9eTx3ZF8ifA6y6CwknWaWU7dp=sQ-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2014-08-25 16:41                                   ` Nicolas Dichtel
     [not found]                                     ` <53FB673F.8070200-pdR9zngts4EAvxtiuMwx3w@public.gmane.org>
2014-08-25 16:50                                       ` Andy Lutomirski
2014-08-27 15:17                                         ` Richard Guy Briggs
2014-08-21  1:09   ` [PATCH V4 4/8] Documentation: add a section for /proc/<pid>/ns/ Richard Guy Briggs
2014-08-21  1:09   ` [PATCH V4 5/8] namespaces: expose ns_entries Richard Guy Briggs
2014-08-21  1:09   ` [PATCH V4 6/8] audit: log namespace serial numbers Richard Guy Briggs
2014-08-21  1:09   ` [PATCH V4 7/8] audit: log creation and deletion of namespace instances Richard Guy Briggs
2014-08-21 20:05   ` [PATCH V4 0/8] namespaces: log namespaces per task Aristeu Rozanski
     [not found]     ` <20140821200555.GK5620-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2014-08-21 22:32       ` Richard Guy Briggs
2014-08-21  1:09 ` [PATCH V4 8/8] audit: initialize at subsystem time rather than device time Richard Guy Briggs

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CALCETrW+vtPnB47aCxfKFxkmKxZS2QsWCkazCc776yg0aPPidA@mail.gmail.com \
    --to=luto-klttt9wpgjjwatoyat5jvq@public.gmane.org \
    --cc=arozansk-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \
    --cc=containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org \
    --cc=ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org \
    --cc=eparis-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \
    --cc=linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=linux-audit-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \
    --cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=rgb-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \
    --cc=serge-A9i7LUbDfNHQT0dZR+AlfA@public.gmane.org \
    --cc=sgrubb-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).