[RFC PATCH 5 4/7] nfs - cache_lib use service thread if not executing in init namespace

2015-03-30 Thread Ian Kent
From: Ian Kent If pipefs is registered within a container pipefs requests should be run within their originating container also. To do that get a token to a service thread created within the container environment for usermode helper calls. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc

[RFC PATCH 5 6/7] KEYS - use correct memory allocation flag in call_usermodehelper_keys()

2015-03-30 Thread Ian Kent
From: Ian Kent When call_usermodehelper_keys() is called it assumes it won't be called with the flag UMH_NO_WAIT. Currently that's always the case. Change this to check the flag and use the correct kernel memory allocation flag to guard against future changes. Signed-off-by: Ia

[RFC PATCH 5 7/7] KEYS: exec request key within service thread of key creator

2015-03-30 Thread Ian Kent
From: Ian Kent Containerized request key helper callbacks need the ability to execute a binary in a container's context. To do that get a token to a service thread created within the container environment for usermode helper calls. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al

[RFC PATCH 5 5/7] nfs - objlayout use service thread if not executing in init namespace

2015-03-30 Thread Ian Kent
From: Ian Kent If the caller is running within a container then execute the usermode helper callback within the container also. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Oleg Nesterov Cc: Eric W. Biederman

[RFC PATCH 5 3/7] nfsd - use service thread if not executing in init namespace

2015-03-30 Thread Ian Kent
From: Ian Kent If nfsd is running within a container the client tracking operations should run within their originating container also. To do that get a token to a service thread created within the container environment for usermode helper calls. Signed-off-by: Ian Kent Cc: Benjamin Coddington

[RFC PATCH 5 1/7] kmod - add workqueue service thread store

2015-03-30 Thread Ian Kent
From: Ian Kent Persistent use of process information is needed for contained execution in a namespace other than the root init namespace. Use a simple random token as a key to create and store thread information in a hashed list for use by the usermode helper thread runner. Signed-off-by: Ian

[RFC PATCH v5 0/7] Another attempt at contained helper execution

2015-03-30 Thread Ian Kent
and similar. But I'd like to get feedback as to whether I'm on the right track and what I might be missing before spending more time on it. --- Ian Kent (7): kmod - add workqueue service thread store kmod - teach usermodehelper to use service workqueues nfsd - use serv

[RFC PATCH 5 2/7] kmod - teach usermodehelper to use service workqueues

2015-03-30 Thread Ian Kent
ion environment. This can be done by creating a service thread, identified by issuing a token identifier, used when executing the helper with a function that takes the token as a parameter. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc:

Re: [RFC PATCH v4 03/12] vfs - move mnt_namespace definition to linux/mount.h

2015-03-19 Thread Ian Kent
On Thu, 2015-03-19 at 20:14 -0500, Eric W. Biederman wrote: > Ian Kent writes: > > 2> On Thu, 2015-03-19 at 19:47 +, Al Viro wrote: > >> On Tue, Mar 17, 2015 at 10:45:09AM +0800, Ian Kent wrote: > >> > From: Ian Kent > >> > > >> > Th

Re: [RFC PATCH v4 00/12] Second attempt at contained helper execution

2015-03-19 Thread Ian Kent
On Thu, 2015-03-19 at 16:38 -0500, Eric W. Biederman wrote: > Ian Kent writes: > > > Here is another update to the attempt at contained helper execution. > > > > The main change is I've tried to incorporate Oleg's suggestions > > of directly construct

Re: [RFC PATCH v4 03/12] vfs - move mnt_namespace definition to linux/mount.h

2015-03-19 Thread Ian Kent
On Thu, 2015-03-19 at 19:47 +, Al Viro wrote: > On Tue, Mar 17, 2015 at 10:45:09AM +0800, Ian Kent wrote: > > From: Ian Kent > > > > The mnt_namespace definition will be needed by the usermode helper > > contained execution implementation, move it to include/l

[RFC PATCH v4 02/12] kmod - rename call_usermodehelper() flags parameter

2015-03-16 Thread Ian Kent
From: Ian Kent The wait parameter of call_usermodehelper() is not quite a parameter that describes the wait behaviour alone and will later be used to request execution within the current namespaces. This flag is tied to the wait field of the subprocess_info structure which is also a field that

[RFC PATCH v4 05/12] kmod - teach call_usermodehelper() to use a namespace

2015-03-16 Thread Ian Kent
From: Ian Kent The call_usermodehelper() function executes all binaries in the global "init" root context. This doesn't allow a binary to be run within a namespace (eg. the namespaces of a container). The init process of the callers environment is used to setup the namespaces in

[RFC PATCH v4 04/12] kmod - add namespace aware thread runner

2015-03-16 Thread Ian Kent
From: Ian Kent Make usermode helper thread runner namespace aware. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Oleg Nesterov Cc: Eric W. Biederman Cc: Jeff Layton --- include/linux/kmod.h | 12

[RFC PATCH v4 09/12] nfs - cache_lib use namespace if not executing in init namespace

2015-03-16 Thread Ian Kent
From: Ian Kent If pipefs is registered within a namespace other than the root init namespace subsequent pipefs requests should be run within the init namespace of registration. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond

[RFC PATCH v4 10/12] nfs - objlayout use namespace if not executing in init namespace

2015-03-16 Thread Ian Kent
From: Ian Kent If the caller is running within a container then execute the usermode helper callback within the init namespace of the container. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Oleg Nesterov Cc

[RFC PATCH v4 12/12] KEYS: exec request-key within the requesting task's init namespace

2015-03-16 Thread Ian Kent
From: Ian Kent Containerized request key helper callbacks need the ability to execute a binary in a container's context. To do this calling an in kernel equivalent of setns(2) should be sufficient since the user mode helper execution kernel thread ultimately calls do_execve(). Signed-o

[RFC PATCH v4 07/12] kmod - add call_usermodehelper_ns()

2015-03-16 Thread Ian Kent
From: Ian Kent Add function call_usermodehelper_ns() to allow passing a namespace token to lookup previously stored namespace information for usermode helper execution. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc

[RFC PATCH v4 08/12] nfsd - use namespace if not executing in init namespace

2015-03-16 Thread Ian Kent
From: Ian Kent If nfsd is running within a container the client tracking operations should run within the originating container also. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Oleg Nesterov Cc: Eric W

[RFC PATCH v4 11/12] KEYS - use correct memory allocation flag in call_usermodehelper_keys()

2015-03-16 Thread Ian Kent
From: Ian Kent When call_usermodehelper_keys() is called it assumes it won't be called with the flag UMH_NO_WAIT. Currently that's always the case. Change this to check the flag and use the correct kernel memory allocation flag to guard against future changes. Signed-off-by: Ia

[RFC PATCH v4 06/12] kmod - add namespace info store

2015-03-16 Thread Ian Kent
From: Ian Kent Persistent use of namespace information is needed where contained execution is needed in a namespace other than the current namespace. Use a simple random token as a key to store namespace information in a hashed list for later usermode helper execution. Signed-off-by: Ian Kent

[RFC PATCH v4 00/12] Second attempt at contained helper execution

2015-03-16 Thread Ian Kent
ed previously. I'm not at all sure I've done this in a sensible way but the token does need to be accessible at helper execution time which is why I've done it this way. I definitely need advice here too. --- Ian Kent (12): nsproxy - make create_new_namespaces() non-stat

[RFC PATCH v4 03/12] vfs - move mnt_namespace definition to linux/mount.h

2015-03-16 Thread Ian Kent
From: Ian Kent The mnt_namespace definition will be needed by the usermode helper contained execution implementation, move it to include/linux/mount.h. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Oleg Nesterov

[RFC PATCH v4 01/12] nsproxy - make create_new_namespaces() non-static

2015-03-16 Thread Ian Kent
From: Ian Kent create_new_namespaces() will be needed by usermodehelper namespace restricted execution. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Stanislav Kinsbursky Cc: Oleg Nesterov Cc: Eric W. Biederman

Re: [RFC PATCH 5/8] KEYS: exec request-key within the requesting task's init namespace

2015-02-24 Thread Ian Kent
On Mon, 2015-02-23 at 17:22 -0800, Benjamin Coddington wrote: > On Tue, 24 Feb 2015, Ian Kent wrote: > > > On Mon, 2015-02-23 at 09:52 -0500, J. Bruce Fields wrote: > > > On Sat, Feb 21, 2015 at 11:58:58AM +0800, Ian Kent wrote: > > > > On Fri, 2015-02-20 at 1

Re: [RFC PATCH 5/8] KEYS: exec request-key within the requesting task's init namespace

2015-02-23 Thread Ian Kent
On Mon, 2015-02-23 at 09:52 -0500, J. Bruce Fields wrote: > On Sat, Feb 21, 2015 at 11:58:58AM +0800, Ian Kent wrote: > > On Fri, 2015-02-20 at 14:05 -0500, J. Bruce Fields wrote: > > > On Fri, Feb 20, 2015 at 12:07:15PM -0600, Eric W. Biederman wrote: > > >

Re: [RFC PATCH 5/8] KEYS: exec request-key within the requesting task's init namespace

2015-02-20 Thread Ian Kent
On Fri, 2015-02-20 at 14:05 -0500, J. Bruce Fields wrote: > On Fri, Feb 20, 2015 at 12:07:15PM -0600, Eric W. Biederman wrote: > > "J. Bruce Fields" writes: > > > > > On Fri, Feb 20, 2015 at 05:33:25PM +0800, Ian Kent wrote: > > > > >> The cas

Re: [RFC PATCH 5/8] KEYS: exec request-key within the requesting task's init namespace

2015-02-20 Thread Ian Kent
On Wed, 2015-02-18 at 20:31 -0500, J. Bruce Fields wrote: > On Thu, Feb 19, 2015 at 08:39:01AM +0800, Ian Kent wrote: > > On Wed, 2015-02-18 at 15:59 -0500, J. Bruce Fields wrote: > > > On Wed, Feb 18, 2015 at 12:31:32PM -0500, J. Bruce Fields wrote: > > > > On W

Re: [RFC PATCH 5/8] KEYS: exec request-key within the requesting task's init namespace

2015-02-18 Thread Ian Kent
On Wed, 2015-02-18 at 20:31 -0500, J. Bruce Fields wrote: > On Thu, Feb 19, 2015 at 08:39:01AM +0800, Ian Kent wrote: > > On Wed, 2015-02-18 at 15:59 -0500, J. Bruce Fields wrote: > > > On Wed, Feb 18, 2015 at 12:31:32PM -0500, J. Bruce Fields wrote: > > > > On W

Re: [RFC PATCH 5/8] KEYS: exec request-key within the requesting task's init namespace

2015-02-18 Thread Ian Kent
On Wed, 2015-02-18 at 15:59 -0500, J. Bruce Fields wrote: > On Wed, Feb 18, 2015 at 12:31:32PM -0500, J. Bruce Fields wrote: > > On Wed, Feb 18, 2015 at 12:06:20PM -0500, J. Bruce Fields wrote: > > > On Fri, Feb 06, 2015 at 09:47:25AM +0800, Ian Kent wrote: > > > &g

Re: [RFC PATCH 3/8] kmod - teach call_usermodehelper() to use a namespace

2015-02-17 Thread Ian Kent
On Mon, 2015-02-16 at 19:24 +0100, Oleg Nesterov wrote: > On 02/16, Oleg Nesterov wrote: > > > > On 02/16, Ian Kent wrote: > > > > > > On Tue, 2015-02-10 at 17:55 +0100, Oleg Nesterov wrote: > > > > On 02/10, Ian Kent wrote: > > > > >

Re: [RFC PATCH 3/8] kmod - teach call_usermodehelper() to use a namespace

2015-02-17 Thread Ian Kent
On Mon, 2015-02-16 at 18:13 +0100, Oleg Nesterov wrote: > On 02/16, Ian Kent wrote: > > > > On Tue, 2015-02-10 at 17:55 +0100, Oleg Nesterov wrote: > > > On 02/10, Ian Kent wrote: > > > > > > > > On Mon, 2015-02-09 at 17:03 +0100, Oleg Nesterov wrot

Re: [RFC PATCH 3/8] kmod - teach call_usermodehelper() to use a namespace

2015-02-15 Thread Ian Kent
On Tue, 2015-02-10 at 17:55 +0100, Oleg Nesterov wrote: > On 02/10, Ian Kent wrote: > > > > On Mon, 2015-02-09 at 17:03 +0100, Oleg Nesterov wrote: > > > > > > I understand. but I still can't understand why we can't implement > > > som

Re: [PATCH] autofs4: Wrong format for printing dentry

2015-02-11 Thread Ian Kent
On Wed, 2015-02-11 at 21:41 +0100, Rasmus Villemoes wrote: > Ping... The patch looks fine to me. I'll check there are no other instances of this and send it to Al. > > On Fri, Feb 06 2015, Rasmus Villemoes wrote: > > > %pD for struct file*, %pd for struct dentry*. > > > > Fixes: a455589f181e (

Re: [RFC PATCH 3/8] kmod - teach call_usermodehelper() to use a namespace

2015-02-10 Thread Ian Kent
On Tue, 2015-02-10 at 17:55 +0100, Oleg Nesterov wrote: > On 02/10, Ian Kent wrote: > > > > On Mon, 2015-02-09 at 17:03 +0100, Oleg Nesterov wrote: > > > > > > I understand. but I still can't understand why we can't implement > > > som

Re: [RFC PATCH 3/8] kmod - teach call_usermodehelper() to use a namespace

2015-02-09 Thread Ian Kent
On Mon, 2015-02-09 at 17:03 +0100, Oleg Nesterov wrote: > On 02/09, Ian Kent wrote: > > > > On Sun, 2015-02-08 at 20:00 +0100, Oleg Nesterov wrote: > > > > + > > > > + this = file_open_root(mnt->mnt_root, mnt, path, > > > > O_RDO

Re: [RFC PATCH 3/8] kmod - teach call_usermodehelper() to use a namespace

2015-02-08 Thread Ian Kent
On Sun, 2015-02-08 at 20:00 +0100, Oleg Nesterov wrote: > On 02/05, Ian Kent wrote: > > > > +int umh_enter_ns(struct task_struct *tsk, struct cred *new) > > +{ > > + char path[NS_PATH_MAX]; > > + struct vfsmount *mnt; > > + const char *name;

Re: [RFC PATCH 3/8] kmod - teach call_usermodehelper() to use a namespace

2015-02-07 Thread Ian Kent
On Fri, 2015-02-06 at 07:08 -0500, Jeff Layton wrote: > On Thu, 05 Feb 2015 10:34:11 +0800 > Ian Kent wrote: > > > The call_usermodehelper() function executes all binaries in the > > global "init" root context. This doesn't allow a binary to be run > >

Re: [RFC PATCH 5/8] KEYS: exec request-key within the requesting task's init namespace

2015-02-05 Thread Ian Kent
On Thu, 2015-02-05 at 15:14 +, David Howells wrote: > > > + /* If running within a container use the container namespace */ > > + if (current->nsproxy->net_ns != &init_net) > > Is that a viable check? Is it possible to have a container that shares > networking details? That's up for dis

Re: [RFC PATCH 2/8] kmod - rename call_usermodehelper() flags parameter

2015-02-05 Thread Ian Kent
On Thu, 2015-02-05 at 15:01 +, David Howells wrote: > Ian Kent wrote: > > > -call_usermodehelper(char *path, char **argv, char **envp, int wait); > > +call_usermodehelper(char *path, char **argv, char **envp, int flags); > > Can we make flags unsigned whilst we&#x

[RFC PATCH 8/8] nfs - objlayout use namespace if not executing in init namespace

2015-02-04 Thread Ian Kent
If the caller is running within a container then execute the usermode helper callback within the init namespace of the container. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Oleg Nesterov Cc: Eric W. Biederman

[RFC PATCH 0/8] v3 contained usermode helper execution

2015-02-04 Thread Ian Kent
code. It's also not clear if the request key infrastructure will continue to use a usermode callback so we'll need to wait on that. --- Ian Kent (8): nsproxy - refactor setns() kmod - rename call_usermodehelper() flags parameter kmod - teach call_usermodehelper() to use a

[RFC PATCH 2/8] kmod - rename call_usermodehelper() flags parameter

2015-02-04 Thread Ian Kent
The wait parameter of call_usermodehelper() is not quite a parameter that describes the wait behaviour alone and will later be used to request exec within a namespace. So change its name to flags. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David

[RFC PATCH 5/8] KEYS: exec request-key within the requesting task's init namespace

2015-02-04 Thread Ian Kent
Containerized request key helper callbacks need the ability to execute a binary in a container's context. To do this calling an in kernel equivalent of setns(2) should be sufficient since the user mode helper execution kernel thread ultimately calls do_execve(). Signed-off-by: Ian Ken

[RFC PATCH 3/8] kmod - teach call_usermodehelper() to use a namespace

2015-02-04 Thread Ian Kent
r's context. To do this use the init process of the callers environment is used to setup the namespaces in the same way the root init process is used otherwise. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Oleg

[RFC PATCH 7/8] nfs - cache_lib use namespace if not executing in init namespace

2015-02-04 Thread Ian Kent
If the caller is running within a container then execute the usermode helper callback within the init namespace of the container. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Oleg Nesterov Cc: Eric W. Biederman

[RFC PATCH 4/8] KEYS - rename call_usermodehelper_keys() flags parameter

2015-02-04 Thread Ian Kent
The wait parameter of call_usermodehelper_keys() will later be used to request exec within a namespace. So change its name to flags. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Oleg Nesterov Cc: Eric W

[RFC PATCH 6/8] nfsd - use namespace if not executing in init namespace

2015-02-04 Thread Ian Kent
If nfsd is running within a container the client tracking operations should run within the container also. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Oleg Nesterov Cc: Eric W. Biederman Cc: Jeff Layton --- fs

[RFC PATCH 1/8] nsproxy - refactor setns()

2015-02-04 Thread Ian Kent
For usermode helpers to execute within a namspace a slightly different entry point to setns() that takes a namspace inode is needed. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Oleg Nesterov Cc: Eric W. Biederman

Re: [RFC PATCH 1/8] nsproxy - refactor setns()

2015-02-02 Thread Ian Kent
Oops! Please ignore these, mistakenly sent. On Tue, 2015-02-03 at 15:16 +0800, Ian Kent wrote: > For usermode helpers to execute within a namspace a slightly different > entry point to setns() that takes a namspace inode is needed. > > Signed-off-by: Ian Kent > Cc: Benjamin Coddi

[RFC PATCH 1/8] nsproxy - refactor setns()

2015-02-02 Thread Ian Kent
For usermode helpers to execute within a namspace a slightly different entry point to setns() that takes a namspace inode is needed. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Oleg Nesterov Cc: Eric W. Biederman

[RFC PATCH 2/8] kmod - rename call_usermodehelper() flags parameter

2015-02-02 Thread Ian Kent
The wait parameter of call_usermodehelper() is not quite a parameter that describes the wait behaviour alone and will later be used to request exec within a namespace. So change its name to flags. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David

Re: [RFC PATCH 0/5] Second attempt at contained helper execution

2015-01-21 Thread Ian Kent
On Wed, 2015-01-21 at 09:38 -0500, J. Bruce Fields wrote: > On Wed, Jan 21, 2015 at 03:05:25PM +0800, Ian Kent wrote: > > On Fri, 2015-01-16 at 10:25 -0500, J. Bruce Fields wrote: > > > On Fri, Jan 16, 2015 at 09:01:13AM +0800, Ian Kent wrote: > > > > On Thu, 2015-

Re: [RFC PATCH 0/5] Second attempt at contained helper execution

2015-01-20 Thread Ian Kent
On Fri, 2015-01-16 at 10:25 -0500, J. Bruce Fields wrote: > On Fri, Jan 16, 2015 at 09:01:13AM +0800, Ian Kent wrote: > > On Thu, 2015-01-15 at 11:27 -0500, J. Bruce Fields wrote: > > > On Thu, Jan 15, 2015 at 08:26:12AM +0800, Ian Kent wrote: > > > > On Wed, 2015-

Re: [RFC PATCH 3/5] kmod - teach call_usermodehelper() to use a namespace

2015-01-15 Thread Ian Kent
On Thu, 2015-01-15 at 11:45 -0500, Jeff Layton wrote: > On Wed, 14 Jan 2015 17:32:43 +0800 > Ian Kent wrote: > > > The call_usermodehelper() function executes all binaries in the > > global "init" root context. This doesn't allow a binary to be run > >

Re: [RFC PATCH 0/5] Second attempt at contained helper execution

2015-01-15 Thread Ian Kent
On Thu, 2015-01-15 at 11:27 -0500, J. Bruce Fields wrote: > On Thu, Jan 15, 2015 at 08:26:12AM +0800, Ian Kent wrote: > > On Wed, 2015-01-14 at 17:10 -0500, J. Bruce Fields wrote: > > > > On Wed, Jan 14, 2015 at 05:32:22PM +0800, Ian Kent wrote: > > > > > There

Re: [RFC PATCH 0/5] Second attempt at contained helper execution

2015-01-14 Thread Ian Kent
On Wed, 2015-01-14 at 17:10 -0500, J. Bruce Fields wrote: > > On Wed, Jan 14, 2015 at 05:32:22PM +0800, Ian Kent wrote: > > > There are other difficulties to tackle as well, such as how to decide > > > if contained helper execution is needed. For example, if a mount has &g

[RFC PATCH 3/5] kmod - teach call_usermodehelper() to use a namespace

2015-01-14 Thread Ian Kent
r's context. To do this use the init process of the callers environment is used to setup the namespaces in the same way the root init process is used otherwise. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Oleg

[RFC PATCH 2/5] kmod - rename call_usermodehelper() flags parameter

2015-01-14 Thread Ian Kent
The wait parameter of call_usermodehelper() is not quite a parameter that describes the wait behaviour alone and will later be used to request exec within a namespace. So change its name to flags. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David

[RFC PATCH 1/5] nsproxy - refactor setns()

2015-01-14 Thread Ian Kent
For usermode helpers to execute within a namspace a slightly different entry point to setns() that takes a namspace inode is needed. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Oleg Nesterov Cc: Eric W. Biederman

[RFC PATCH 4/5] KEYS - rename call_usermodehelper_keys() flags parameter

2015-01-14 Thread Ian Kent
The wait parameter of call_usermodehelper_keys() will later be used to request exec within a namespace. So change its name to flags. Signed-off-by: Ian Kent Cc: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Oleg Nesterov Cc: Eric W

[RFC PATCH 5/5] KEYS: exec request-key within the requesting task's init namespace

2015-01-14 Thread Ian Kent
Containerized request key helper callbacks need the ability to execute a binary in a container's context. To do this calling an in kernel equivalent of setns(2) should be sufficient since the user mode helper execution kernel thread ultimately calls do_execve(). Signed-off-by: Ian Ken

[RFC PATCH 0/5] Second attempt at contained helper execution

2015-01-14 Thread Ian Kent
od that is used here to enter the target namespace which probably needs work but is out of scope for this series if in fact this approach is even acceptable. Comments please? --- Ian Kent (5): nsproxy - refactor setns() kmod - rename call_usermodehelper() flags parameter kmod - tea

Re: [RFC PATCH 3/4] kmod - add call_usermodehelper_ns() helper

2014-12-03 Thread Ian Kent
On Wed, 2014-12-03 at 10:49 -0600, Eric W. Biederman wrote: > Ian Kent writes: > > > On Mon, 2014-12-01 at 16:56 -0500, Benjamin Coddington wrote: > >> n Tue, 25 Nov 2014, Eric W. Biederman wrote: > >> Hi, > >> > >> > Ian Kent writes: > &

Re: [RFC PATCH 3/4] kmod - add call_usermodehelper_ns() helper

2014-12-03 Thread Ian Kent
On Wed, 2014-12-03 at 10:49 -0600, Eric W. Biederman wrote: > > >> > Those are the general parameters. > >> > >> It does seem very expensive to keep a thread around for every mount; I'm > >> still trying to find a way around it.. > > > > Yeah, that's not such a good idea. > > > > Several hundred

Re: [RFC PATCH 3/4] kmod - add call_usermodehelper_ns() helper

2014-12-02 Thread Ian Kent
On Mon, 2014-12-01 at 16:56 -0500, Benjamin Coddington wrote: > n Tue, 25 Nov 2014, Eric W. Biederman wrote: > Hi, > > > Ian Kent writes: > > > > > On Tue, 2014-11-25 at 17:19 -0600, Eric W. Biederman wrote: > > >> Ian Kent writes: > > >&

Re: [RFC PATCH 3/4] kmod - add call_usermodehelper_ns() helper

2014-11-27 Thread Ian Kent
On Tue, 2014-11-25 at 17:27 -0600, Eric W. Biederman wrote: > > > How does one correctly set the namespace in user space since each of > > the /proc//ns/ will use a slightly different > > proc_ns_operations install function? > > > > Are we saying that, for example, if open(/proc//ns/pid)/setns()

Re: [RFC PATCH 3/4] kmod - add call_usermodehelper_ns() helper

2014-11-25 Thread Ian Kent
On Wed, 2014-11-26 at 07:50 +0800, Ian Kent wrote: > > > > If we are going to set this stuff up in the kernel we need a reference > > process that we can create children of because what is possible with > > respect to containers keeps changing, and it is extremely error

Re: [RFC PATCH 3/4] kmod - add call_usermodehelper_ns() helper

2014-11-25 Thread Ian Kent
On Tue, 2014-11-25 at 17:19 -0600, Eric W. Biederman wrote: > Ian Kent writes: > > > On Tue, 2014-11-25 at 16:23 -0600, Eric W. Biederman wrote: > >> Oleg Nesterov writes: > >> > >> > On 11/25, Oleg Nesterov wrote: > >> >> > >>

Re: [RFC PATCH 3/4] kmod - add call_usermodehelper_ns() helper

2014-11-25 Thread Ian Kent
sed. > > Yes. > > And I have another concern... this is mostly a feeling, I can be > easily wrong but: > > > On 11/25, Ian Kent wrote: > > > > > > +static int umh_set_ns(struct subprocess_info *info, struct cred *new) > > > +{ > > > + struct n

Re: [RFC PATCH 3/4] kmod - add call_usermodehelper_ns() helper

2014-11-25 Thread Ian Kent
o not like this approach... > >> probably I am biased. > > > > Yes. > > > > And I have another concern... this is mostly a feeling, I can be > > easily wrong but: > > > >> On 11/25, Ian Kent wrote: > >> > > >> &g

Re: [RFC PATCH 3/4] kmod - add call_usermodehelper_ns() helper

2014-11-25 Thread Ian Kent
On Tue, 2014-11-25 at 22:52 +0100, Oleg Nesterov wrote: > Let me first apologize, I didn't actually read this series yet. > > But I have to admit that so far I do not like this approach... > probably I am biased. Oleg, thanks for your comments. > > On 11/25, Ian

[RFC PATCH 2/4] nsproxy - make create_new_namespaces() non-static

2014-11-24 Thread Ian Kent
create_new_namespaces() will be needed by call_usermodehelper_ns() and call_usermodehelper_keys() for namespace restricted execution. Signed-off-by: Ian Kent Signed-off-by: Benjamin Coddington Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Stanislav Kinsbursky Cc

[RFC PATCH 4/4] KEYS: exec request-key within the requesting task's namespace

2014-11-24 Thread Ian Kent
From: Benjamin Coddington Copy the current task's namespaces into the request-key userspace helper to restrict contained processes from executing key instantiation processes outside their containers. Signed-off-by: Benjamin Coddington Signed-off-by: Ian Kent Cc: Al Viro Cc: J. Bruce F

[RFC PATCH 3/4] kmod - add call_usermodehelper_ns() helper

2014-11-24 Thread Ian Kent
server need the ability to execute a binary within their container. To do this create a new nsproxy within the callers' context so it can be used for setup prior to calling do_execve() from the user mode helper thread runner. Signed-off-by: Ian Kent Signed-off-by: Benjamin Coddington Cc: A

[RFC PATCH 1/4] vfs - fs/namespaces.c: break out mntns_setfs() from mntns_install()

2014-11-24 Thread Ian Kent
igned-off-by: Benjamin Coddington Signed-off-by: Ian Kent Cc: Al Viro Cc: J. Bruce Fields Cc: David Howells Cc: Trond Myklebust Cc: Stanislav Kinsbursky Cc: Oleg Nesterov Cc: Eric W. Biederman --- fs/namespace.c| 41 + include/linux/mo

[RFC PATCH 0/4] Namespace contrained helper execution

2014-11-24 Thread Ian Kent
ppropriate namespace environment then switch to it and setup fs_struct for path walking prior to the user mode helper thread runner calling do_execve(). Please review and comment on the patch series. Ian --- Benjamin Coddington (1): KEYS: exec request-key within the requesting task's name

Re: [PATCH 1/3] autofs - fix log print messages

2014-11-12 Thread Ian Kent
On Thu, 2014-11-13 at 08:10 +0800, Ian Kent wrote: > > > > The tree which these patches were based on seem to have more than a > > plain rename. For example I get > > Right, looks like something has gone missing along the way. Ahh .. I get it now. > The tree the pa

Re: [PATCH 1/3] autofs - fix log print messages

2014-11-12 Thread Ian Kent
On Wed, 2014-11-12 at 15:07 -0800, Andrew Morton wrote: > On Tue, 11 Nov 2014 14:01:52 +0800 Ian Kent wrote: > > > I guess I could make a kernel.org tree but, apart from this recent > > rename autofs4 -> autofs, the number of autofs changes hasn't warranted > >

Re: [PATCH 1/3] autofs - fix log print messages

2014-11-10 Thread Ian Kent
On Mon, 2014-11-10 at 21:49 -0800, Joe Perches wrote: > On Tue, 2014-11-11 at 13:37 +0800, Ian Kent wrote: > > On Mon, 2014-11-10 at 19:25 -0800, Joe Perches wrote: > > > On Tue, 2014-11-11 at 09:29 +0800, Ian Kent wrote: > > > > Fix some inconsistencies in lo

Re: [PATCH 1/3] autofs - fix log print messages

2014-11-10 Thread Ian Kent
On Mon, 2014-11-10 at 21:49 -0800, Joe Perches wrote: > On Tue, 2014-11-11 at 13:37 +0800, Ian Kent wrote: > > On Mon, 2014-11-10 at 19:25 -0800, Joe Perches wrote: > > > On Tue, 2014-11-11 at 09:29 +0800, Ian Kent wrote: > > > > Fix some inconsistencies in lo

Re: [PATCH 1/3] autofs - fix log print messages

2014-11-10 Thread Ian Kent
On Mon, 2014-11-10 at 19:25 -0800, Joe Perches wrote: > On Tue, 2014-11-11 at 09:29 +0800, Ian Kent wrote: > > Fix some inconsistencies in log print output and ensure that > > the module name is included in all log prints. > > > > Signed-off-by: Ian Kent > >

[PATCH 2/3] autofs - change log prints to not insert newline

2014-11-10 Thread Ian Kent
Common kernel coding practice is to include the newline of log prints within the log text rather than hidden away in a macro. To avoid introducing inconsistencies as changes are made change the log macros to not include the newline. Signed-off-by: Ian Kent Cc: Joe Perches --- fs/autofs

[PATCH 3/3] autofs - use pr_xxx() calls directly for logging

2014-11-10 Thread Ian Kent
From: Ian Kent --- fs/autofs/autofs_i.h | 15 --- fs/autofs/dev-ioctl.c | 26 +- fs/autofs/expire.c| 42 +- fs/autofs/inode.c | 17 - fs/autofs/root.c | 44

[PATCH 1/3] autofs - fix log print messages

2014-11-10 Thread Ian Kent
Fix some inconsistencies in log print output and ensure that the module name is included in all log prints. Signed-off-by: Ian Kent Cc: Joe Perches --- fs/autofs/autofs_i.h |6 +++--- fs/autofs/dev-ioctl.c |2 +- fs/autofs/inode.c | 10 +- fs/autofs/waitq.c |4

Re: [PATCH 04/13] autofs4 - change printks AUTOFS defined prints

2014-11-05 Thread Ian Kent
On Wed, 2014-11-05 at 15:20 -0800, Joe Perches wrote: > > > But idea of using pr_xxx() and pr_fmt() (actually that's too open to > > name clashes so it would need to be named something like autofs_pr_fmt() > > anyway) looks like it results in less readable code so I'd really prefer > > not to do t

Re: [PATCH 04/13] autofs4 - change printks AUTOFS defined prints

2014-11-05 Thread Ian Kent
On Mon, 2014-11-03 at 06:33 -0800, Joe Perches wrote: > > That's fine. I left out the trailing semicolon/space. > The pr_fmt could be something like: > #define pr_fmt(fmt) KBUILD_MODNAME ":%d:%s: " fmt, current->pid, __func__ > or add a "pid:" descriptor prefix if you like too: > #define pr_fmt(f

Re: [PATCH 04/13] autofs4 - change printks AUTOFS defined prints

2014-11-03 Thread Ian Kent
On Mon, 2014-11-03 at 00:25 -0800, Joe Perches wrote: > On Mon, 2014-11-03 at 16:12 +0800, Ian Kent wrote: > > Use the AUTOFS_*() print defines instead of raw printks. > > Please check the output of these conversions. > > For instance: > > > diff --git a/fs/autofs

[PATCH 03/13] autofs4 - use pr print in AUTOFS prints

2014-11-03 Thread Ian Kent
Use the pr_*() print in AUTOFS_*() defines instead of printks. Signed-off-by: Ian Kent --- fs/autofs4/autofs_i.h |4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h index 0a1fcdc..b33b939 100644 --- a/fs/autofs4/autofs_i.h

[PATCH 07/13] autofs - merge auto_fs.h and auto_fs4.h

2014-11-03 Thread Ian Kent
The autofs module has long since been removed so there's no need to have two separate include files for autofs. Signed-off-by: Ian Kent --- fs/autofs4/autofs_i.h |2 - fs/compat_ioctl.c |1 include/uapi/linux/auto_fs.h |

[PATCH 11/13] autofs - update fs/autofs4/Kconfig

2014-11-03 Thread Ian Kent
Update Kconfig and add a depricated warning. Signed-off-by: Ian Kent --- fs/autofs4/Kconfig | 32 ++-- 1 file changed, 22 insertions(+), 10 deletions(-) diff --git a/fs/autofs4/Kconfig b/fs/autofs4/Kconfig index 1204d63..26dbb00 100644 --- a/fs/autofs4/Kconfig

[PATCH 09/13] autofs - copy autofs4 to autofs

2014-11-03 Thread Ian Kent
Copy source files from the autofs4 directory to the autofs directory. Signed-off-by: Ian Kent --- fs/autofs/autofs_i.h | 283 +++ fs/autofs/dev-ioctl.c | 763 fs/autofs/expire.c| 618 fs/autofs/init.c

[PATCH 13/13] autofs - delete fs/autofs4 source files

2014-11-03 Thread Ian Kent
Delete the now unused autofs4 module files. Signed-off-by: Ian Kent --- fs/autofs4/autofs_i.h | 283 -- fs/autofs4/dev-ioctl.c | 764 --- fs/autofs4/expire.c| 619 fs/autofs4/init.c | 49 --- fs

[PATCH 06/13] autofs4 - move linux/auto_dev-ioctl.h to uapi/linux

2014-11-03 Thread Ian Kent
Since linux/auto_dev-ioctl.h wasn't included in include/linux/Kbuild (although I should have added it) it wasn't moved to uapi/linux as part of the uapi series. Signed-off-by: Ian Kent --- include/linux/auto_dev-ioctl.h | 223 --- include/

[PATCH 10/13] autofs - create autofs Kconfig and Makefile

2014-11-03 Thread Ian Kent
Create Makefile and Kconfig for autofs module. Signed-off-by: Ian Kent --- fs/Kconfig |1 + fs/Makefile|1 + fs/autofs/Kconfig | 19 +++ fs/autofs/Makefile |7 +++ 4 files changed, 28 insertions(+) create mode 100644 fs/autofs/Kconfig create

[PATCH 05/13] autofs4 - fix string.h include in auto_dev-ioctl.h

2014-11-03 Thread Ian Kent
Since including linux/string.h will now do the right thing remove the conditional check. Signed-off-by: Ian Kent --- include/linux/auto_dev-ioctl.h |5 - 1 file changed, 5 deletions(-) diff --git a/include/linux/auto_dev-ioctl.h b/include/linux/auto_dev-ioctl.h index 6427816..7caaf29

[PATCH 12/13] autofs - update fs/autofs4/Makefile

2014-11-03 Thread Ian Kent
Update Makefile to build from source in fs/autofs instead of fs/autofs4. Signed-off-by: Ian Kent --- fs/autofs4/Makefile |4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/autofs4/Makefile b/fs/autofs4/Makefile index a811c1f..417dd72 100644 --- a/fs/autofs4/Makefile

[PATCH 08/13] autofs - use autofs instead of autofs4 everywhere

2014-11-03 Thread Ian Kent
Update naming within autofs source to be consistent by changing occurrences of autofs4 to autofs. Signed-off-by: Ian Kent --- fs/autofs4/autofs_i.h | 88 fs/autofs4/dev-ioctl.c | 18 ++- fs/autofs4/expire.c| 132 fs/autofs4/init.c | 12

[PATCH 02/13] autofs4 - fix some white space errors

2014-11-03 Thread Ian Kent
Fix some white space format errors. Signed-off-by: Ian Kent --- fs/autofs4/inode.c|2 +- fs/autofs4/root.c |8 fs/autofs4/waitq.c|2 +- include/uapi/linux/auto_fs.h |2 +- include/uapi/linux/auto_fs4.h |2 +- 5 files changed, 8

[PATCH 01/13] autofs4 - coding style fixes

2014-11-03 Thread Ian Kent
Try and make the coding style completely consistent throughtout the autofs module and inline with kernel coding style recommendations. Signed-off-by: Ian Kent --- fs/autofs4/autofs_i.h | 42 +++-- fs/autofs4/dev-ioctl.c | 24 fs/autofs4/expire.c

<    1   2   3   4   5   6   7   8   >