containerized syslog

RFC PATCH In review Serge E. Hallyn 1 participant 2 messages Feb 4, 2010 1 message not in the archive Proc filesystem

lore

Share & tools

lore

Serge E. Hallyn

author

2010-02-04 06:09 UTC #0 lore raw

RFC PATCH 1/1 containerized syslog

Provide each user namespace with its own syslog ringbuffer.

So you can do
ns_exec -cU /bin/bash
dmesg
and see nothing. Root in a container (with private user namespace) cannot clear the host's ring buffer.

Since containers do not have a notion of consoles at present, only the initial user namespace deals with console output or with the console-related syslog commands.

This opens the door to targetting printk at certain syslog namespaces. It's not safe to be applied - it's a quick-n-dirty hack and won't even compile for CONFIG_PRINTK=n. Also I've not decided what to do about duplication of printks to init_user_ns so for now emit_one_char always duplicates to inti_user_ns. We probably want to be smarter about this and output a prefix indicating the target.

But I figured discussions about the API would be more meaningful with a testable patch.

---
 fs/proc/kmsg.c                 |    5 +-
 include/linux/user_namespace.h |    2 +
 kernel/printk.c                |  225 ++++++++++++++++++++++++++--------------
 kernel/user.c                  |    4 +
 kernel/user_namespace.c        |   13 +++
 5 files changed, 168 insertions(+), 81 deletions(-)

fs/proc/kmsg.c +3 -2

index 7ca7834..2746b70 100644
@@ -12,11 +12,12 @@
 #include <linux/poll.h>
 #include <linux/proc_fs.h>
 #include <linux/fs.h>
+#include <linux/syslog.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
 
-extern wait_queue_head_t log_wait;
+extern struct syslog_ns init_syslog_ns;
 
 extern int do_syslog(int type, char __user *bug, int count);

@@ -41,7 +42,7 @@ static ssize_t kmsg_read(struct file *file, char __user *buf,
 
 static unsigned int kmsg_poll(struct file *file, poll_table *wait)
 {
-	poll_wait(file, &log_wait, wait);
+	poll_wait(file, &init_syslog_ns.wait, wait);
 	if (do_syslog(9, NULL, 0))
 		return POLLIN | POLLRDNORM;
 	return 0;

include/linux/user_namespace.h +2 -0

index cc4f453..3926c89 100644
@@ -5,6 +5,7 @@
 #include <linux/nsproxy.h>
 #include <linux/sched.h>
 #include <linux/err.h>
+#include <linux/syslog.h>
 
 #define UIDHASH_BITS	(CONFIG_BASE_SMALL ? 3 : 8)
 #define UIDHASH_SZ	(1 << UIDHASH_BITS)

@@ -14,6 +15,7 @@ struct user_namespace {
 	struct hlist_head	uidhash_table[UIDHASH_SZ];
 	struct user_struct	*creator;
 	struct work_struct	destroyer;
+	struct syslog_ns	*syslog;
 };
 
 extern struct user_namespace init_user_ns;

kernel/printk.c +146 ~~-79~~

470 lines not on this page · raw message

kernel/user.c +4 -0

index 46d0165..102c2ce 100644
@@ -18,11 +18,15 @@
 #include <linux/user_namespace.h>
 #include "cred-internals.h"
 
+/* defined in kernel/printk.c */
+extern struct syslog_ns init_syslog_ns;
+
 struct user_namespace init_user_ns = {
 	.kref = {
 		.refcount	= ATOMIC_INIT(2),
 	},
 	.creator = &root_user,
+	.syslog = &init_syslog_ns,
 };
 EXPORT_SYMBOL_GPL(init_user_ns);

kernel/user_namespace.c +13 -0

index 076c7c8..43d46d1 100644
@@ -11,6 +11,9 @@
 #include <linux/user_namespace.h>
 #include <linux/cred.h>
 
+/* defined in kernel/printk.c */
+extern struct syslog_ns *do_syslog_init(void);
+
 /*
  * Create a new user namespace, deriving the creator from the user in the
  * passed credentials, and replacing that user with the new root user for the

@@ -34,9 +37,17 @@ int create_user_ns(struct cred *new)
 	for (n = 0; n < UIDHASH_SZ; ++n)
 		INIT_HLIST_HEAD(ns->uidhash_table + n);
 
+	ns->syslog = do_syslog_init();
+	if (!ns->syslog) {
+		kfree(ns);
+		return -ENOMEM;
+	}
+
 	/* Alloc new root user.  */
 	root_user = alloc_uid(ns, 0);
 	if (!root_user) {
+		kfree(ns->syslog->buf);
+		kfree(ns->syslog);
 		kfree(ns);
 		return -ENOMEM;
 	}

@@ -70,6 +81,8 @@ static void free_user_ns_work(struct work_struct *work)
 	struct user_namespace *ns =
 		container_of(work, struct user_namespace, destroyer);
 	free_uid(ns->creator);
+	kfree(ns->syslog->buf);
+	kfree(ns->syslog);
 	kfree(ns);
 }

Signature · 1 line

1.6.1

A message that is not in the archive (sent off-list or not yet received): 20100204060918.GA13193-r/[email protected]

Serge E. Hallyn

author

2010-02-04 20:34 UTC #2 lore raw

Another reason this is bogus, confirmed by Jean-Marc's testing:
printk is called too often without valid 'current', i.e. when network packets arrive and are processed. So we should send output of sys_syslog() to current's ring buffer, all printks to the init_syslog_ns, and then we can use ns_printk(syslog_ns, fmt, ...) for targeted printks.

And, as discussed on irc, we'll make syslog_ns a full namespace in its own right, use the last remaining clone flag (if there is one) or build on top of eclone(). It'd be nicer to have a 'real' clone flag so we can also unshare(CLONE_NEWLOG).

-serge

Quoted 650 lines · Serge E. Hallyn