Re: [patch] PID namespace design bug, workaround

[Pavel Emelyanov <xemul@openvz.org>]

Andrew Morton wrote:
> On Fri, 02 Nov 2007 10:55:02 +0300 Pavel Emelyanov <xemul@openvz.org> wrote:
> 
>> Ulrich Drepper wrote:
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>>
>>> Pavel Emelyanov wrote:
>>>> The "fix" I mention is just returning -EINVAL in case user orders 
>>>> CLONE_NEWPIDS
>>> That is the "fix" you were referring to?  I was hoping you have a sketch
>>> for a real solution.  If nobody can think of a way to fix this PID
>> Looks like we misunderstood each other. Can you please elaborate on 
>> what exactly is broken in pid namespaces?
> 
> Isn't it this?
> 
> http://lkml.org/lkml/2007/11/1/141

That was the initial problem, and I already answered to Ingo about
it - pid, obtained in one pid namespace shouldn't be used in another.
This is not a design bug, but a design idea. If he managed to get two
threads in different namespaces, then we should fix this ability (but 
I thought that I handled it - the copy_pid_ns call doesn't allow to 
create a new thread in a new namespace:

        new_ns = ERR_PTR(-EINVAL);
        if (flags & CLONE_THREAD)
                goto out_put;

) I should have first asked Ingo about how he managed to get two 
threads in different namespaces to fix this, but Ulrich said that 

 "everything else I have seen simply doesn't work without
  breaking something"

so I asked him to elaborate on this - what _else_ doesn't work.

Thanks,
Pavel