From mboxrd@z Thu Jan 1 00:00:00 1970 From: ebiederm@xmission.com (Eric W. Biederman) Subject: Re: [RFC][PATCH] ns: Syscalls for better namespace sharing control. Date: Fri, 26 Feb 2010 14:16:43 -0800 Message-ID: References: <4B4F24AC.70105@trash.net> <1263481549.23480.24.camel@bigi> <4B4F3A50.1050400@trash.net> <1263490403.23480.109.camel@bigi> <4B50403A.6010507@trash.net> <1263568754.23480.142.camel@bigi> <1266875729.3673.12.camel@bigi> <1266931623.3973.643.camel@bigi> <1266934817.3973.654.camel@bigi> <1266966581.3973.675.camel@bigi> <4B883987.6090408@parallels.com> <4B883E6F.1060907@parallels.com> <4B8843FE.4000404@cs.columbia.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Pavel Emelyanov , Ben Greear , Linux Netdev List , containers@lists.linux-foundation.org, Netfilter Development Mailinglist , Daniel Lezcano To: Oren Laadan Return-path: In-Reply-To: <4B8843FE.4000404@cs.columbia.edu> (Oren Laadan's message of "Fri\, 26 Feb 2010 16\:58\:22 -0500") Sender: netfilter-devel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org Oren Laadan writes: > Eric W. Biederman wrote: >> Pavel Emelyanov writes: >> >>>>> Yet another set of per-namespace IDs along with CLONE_NEWXXX ones? >>>>> I currently have a way to create all namespaces we have with one >>>>> syscall. Why don't we have an ability to enter them all with one syscall? >>>> The CLONE_NEWXXX series of bits has been an royal pain to work with, >>>> and it appears to be unnecessary complications for no gain. >>> That's the answer for the "Yet another set..." question. >>> How about the "Why don't we have..." one? >> >> I am not certain which question you are asking: >> >> Why don't we have an ability to enter all namespaces with one syscall >> invocation? > > That's how I understood the question, and I, too, wonder why not ? > > By the way, an alternative to using bitmap is to change the prototype > of setns() to accept an array of FD's: > > int setns(int *fds, int nfds); > > So the process will atomically enter all the namespaces as specified > by the FDs. We could. Mostly I implemented things in the simplest way possible. Semantically I know of no reason why need to enter more than one namespace at once, and I don't expect entering a namespace to be on anyone's fast path so every last drop of performance was not crucial. The only justification I can think of for more than one namespace at a time is that because we have a synchronize_rcu() in the kernel we can loop in the kernel much more quickly than we can loop in userspace. Eric