A config option to compile out some namespaces code (v3)

PATCH In review Pavel Emelyanov 4 participants 12 messages Oct 31, 2007 Namespaces:

Share & tools

Pavel Emelyanov

author

2007-10-31 10:15 UTC #0 lore raw

cover A config option to compile out some namespaces code (v3)

There were some questions like "do I need this on my cellphone" in reply to different namespaces patches. Indeed, the namespaces are not useful for most of the embedded systems, but the code creating and releasing them weights a lot.

So I propose to add a config option which will help embedded people to reduce the vmlinux size. This option simply compiles out the namespaces cloning and releasing code *only*, but keeps all the other logic untouched (e.g. the notion of init_ns).

When someone tries to clone some namespace with their support turned off, he will receive an EINVAL error.

This patchset can save more than 2KB from the vmlinux when turning the config option "NAMESPACES" to "n".

I do not introduce the NAMESPACES_EXPERIMENTAL config option, that switches all the namespaces we consider experimental, but each namespace has its own config that can be mrked with "depends on EXPERIMENTAL" on demand.

This is mainly done because some people consider pid namespaces broken ant will probably want to make them depend on BROKEN. In this case we'll have to introduce the NAMESPACES_BROKEN option which is not that good.

Signed-off-by Pavel Emelyanov <[email protected]>

Pavel Emelyanov

author

2007-10-31 10:21 UTC #1 lore raw

PATCH 1/5 The config option itself

The option is called NAMESPACES. It can be selectable only if EMBEDDED is chosen (this was Eric's requisition). When the EMBEDDED is off namespaces will be on automatically.

Signed-off-by Pavel Emelyanov <[email protected]>

---

init/Kconfig +9 -0

index c3de3ed..fc76773 100644
@@ -400,6 +400,15 @@ config RELAY
 
 	  If unsure, say N.
 
+config NAMESPACES
+	bool "Namespaces support" if EMBEDDED
+	default !EMBEDDED
+	help
+	  Provides the way to make tasks work with different objects using
+	  the same id. For example same IPC id may refer to different objects
+	  or same user id or pid may refer to different tasks when used in
+	  different namespaces.
+
 config BLK_DEV_INITRD
 	bool "Initial RAM filesystem and RAM disk (initramfs/initrd) support"
 	depends on BROKEN || !FRV

Signature · 1 line

1.5.3.4

Randy Dunlap

2007-10-31 16:19 UTC #2 lore raw

Re: [PATCH 1/5] The config option itself

Quoted 4 lines · On Wed, 31 Oct 2007 14:05:01 +0300 Pavel Emelyanov wrote:

The option is called NAMESPACES. It can be selectable only if EMBEDDED is chosen (this was Eric's requisition). When the EMBEDDED is off namespaces will be on automatically.
Signed-off-by Pavel Emelyanov <[email protected]>

and when EMBEDDED is on, it looks like NAMESPACES will be off automatically (but user-changeable)? Is that intended?

Quoted 12 lines

---

init/Kconfig +2 -0

index c3de3ed..fc76773 100644
@@ -400,6 +400,15 @@ config RELAY
 
 	  If unsure, say N.
 
+config NAMESPACES
+	bool "Namespaces support" if EMBEDDED

init/Kconfig config RELAY · line 414

Quoted 10 lines

init/Kconfig +7 -0

+	default !EMBEDDED
+	help
+	  Provides the way to make tasks work with different objects using
+	  the same id. For example same IPC id may refer to different objects
+	  or same user id or pid may refer to different tasks when used in
+	  different namespaces.
+
 config BLK_DEV_INITRD
 	bool "Initial RAM filesystem and RAM disk (initramfs/initrd) support"
 	depends on BROKEN || !FRV

---
~Randy

Pavel Emelyanov

author

2007-10-31 16:36 UTC #3 lore raw

Re: [PATCH 1/5] The config option itself

Quoted 10 lines · Randy Dunlap

Quoted 4 lines · On Wed, 31 Oct 2007 14:05:01 +0300 Pavel Emelyanov wrote:
The option is called NAMESPACES. It can be selectable only if EMBEDDED is chosen (this was Eric's requisition). When the EMBEDDED is off namespaces will be on automatically.
Signed-off-by Pavel Emelyanov <[email protected]>
and when EMBEDDED is on, it looks like NAMESPACES will be off automatically (but user-changeable)? Is that intended?

Yes. The namespaces are likely not needed on cell-phones or similar, but if the user does want them - he may turn them on.

This was one of Eric's wishes to give only the embedded people the choice.

Quoted 28 lines

Quoted 13 lines

---

init/Kconfig +2 -0

index c3de3ed..fc76773 100644
@@ -400,6 +400,15 @@ config RELAY
 
 	  If unsure, say N.
 
+config NAMESPACES
+	bool "Namespaces support" if EMBEDDED

init/Kconfig config RELAY · line 414

Quoted 10 lines

init/Kconfig +7 -0

+	default !EMBEDDED
+	help
+	  Provides the way to make tasks work with different objects using
+	  the same id. For example same IPC id may refer to different objects
+	  or same user id or pid may refer to different tasks when used in
+	  different namespaces.
+
 config BLK_DEV_INITRD
 	bool "Initial RAM filesystem and RAM disk (initramfs/initrd) support"
 	depends on BROKEN || !FRV

---
~Randy

Andrew Morton

2007-10-31 22:29 UTC #4 lore raw

Re: [PATCH 1/5] The config option itself

In reply to Pavel Emelyanov

Quoted 3 lines · On Wed, 31 Oct 2007 14:05:01 +0300 Pavel Emelyanov <[email protected]> wrote:

The option is called NAMESPACES. It can be selectable only if EMBEDDED is chosen (this was Eric's requisition). When the EMBEDDED is off namespaces will be on automatically.

I'm thinking that Eric's pidns-place-under-config_experimental.patch is for 2.6.24, so I attempted to rework your patches atop that but gave up on the last one.

So if we're agreeeable, can you please redo these against next -mm, thanks.

Also, please do put a little thought into the choice of patch subjects. "the config option itself" will look rather dopey if it goes into the permanent kernel record under that name.

Probably putting "CONFIG_NAMESPACES: " in front of each of these would suit.

Pavel Emelyanov

author

2007-10-31 10:08 UTC #5 lore raw

PATCH 2/5 Move the UTS namespace under the option

In reply to Pavel Emelyanov

Currently all the namespace management code is in the kernel/utsname.c file, so just compile it out and make stub in .h file.

The init namespace itself is in init/version.c and is left in the kernel.

Signed-off-by Pavel Emelyanov <[email protected]>

---

include/linux/utsname.h +21 -0

index 923db99..1123267 100644
@@ -35,6 +35,7 @@ struct new_utsname {
 #include <linux/sched.h>
 #include <linux/kref.h>
 #include <linux/nsproxy.h>
+#include <linux/err.h>
 #include <asm/atomic.h>
 
 struct uts_namespace {

@@ -43,6 +44,7 @@ struct uts_namespace {
 };
 extern struct uts_namespace init_uts_ns;
 
+#ifdef CONFIG_UTS_NS
 static inline void get_uts_ns(struct uts_namespace *ns)
 {
 	kref_get(&ns->kref);

@@ -56,6 +58,25 @@ static inline void put_uts_ns(struct uts_namespace *ns)
 {
 	kref_put(&ns->kref, free_uts_ns);
 }
+#else
+static inline void get_uts_ns(struct uts_namespace *ns)
+{
+}
+
+static inline void put_uts_ns(struct uts_namespace *ns)
+{
+}
+
+static inline struct uts_namespace *copy_utsname(unsigned long flags,
+					struct uts_namespace *ns)
+{
+	if (flags & CLONE_NEWUTS)
+		return ERR_PTR(-EINVAL);
+
+	return ns;
+}
+#endif
+
 static inline struct new_utsname *utsname(void)
 {
 	return &current->nsproxy->uts_ns->name;

init/Kconfig +7 -0

index fc76773..d592aa2 100644
@@ -409,6 +409,13 @@ config NAMESPACES
 	  or same user id or pid may refer to different tasks when used in
 	  different namespaces.
 
+config UTS_NS
+	bool "UTS namespace"
+	depends on NAMESPACES
+	help
+	  In this namespace tasks see different info provided with the
+	  uname() system call
+
 config BLK_DEV_INITRD
 	bool "Initial RAM filesystem and RAM disk (initramfs/initrd) support"
 	depends on BROKEN || !FRV

kernel/Makefile +2 -1

index 8c99161..8082b2c 100644
@@ -9,7 +9,7 @@ obj-y     = sched.o fork.o exec_domain.o panic.o printk.o profile.o \
 	    rcupdate.o extable.o params.o posix-timers.o \
 	    kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o mutex.o \
 	    hrtimer.o rwsem.o nsproxy.o srcu.o \
-	    utsname.o pm_qos_params.o notifier.o sysctl_check.o
+	    pm_qos_params.o notifier.o sysctl_check.o
 
 obj-$(CONFIG_STACKTRACE) += stacktrace.o
 obj-y += time/

@@ -48,6 +48,7 @@ obj-$(CONFIG_AUDITSYSCALL) += auditsc.o
 obj-$(CONFIG_AUDIT_TREE) += audit_tree.o
 obj-$(CONFIG_KPROBES) += kprobes.o
 obj-$(CONFIG_KGDB) += kgdb.o
+obj-$(CONFIG_UTS_NS) += utsname.o
 obj-$(CONFIG_SYSFS) += ksysfs.o
 obj-$(CONFIG_DETECT_SOFTLOCKUP) += softlockup.o
 obj-$(CONFIG_GENERIC_HARDIRQS) += irq/

Signature · 1 line

1.5.3.4

Cedric Le Goater

2007-10-31 12:58 UTC #6 lore raw

Re: [PATCH 2/5] Move the UTS namespace under the option

init/Kconfig config NAMESPACES · line 414

Quoted 12 lines

init/Kconfig +3 -0

index fc76773..d592aa2 100644
@@ -409,6 +409,13 @@ config NAMESPACES
 	  or same user id or pid may refer to different tasks when used in
 	  different namespaces.
 
+config UTS_NS
+	bool "UTS namespace"
+	depends on NAMESPACES

should we add a 'default y' like in 2.6.23 ?

Pavel Emelyanov

author

2007-10-31 13:06 UTC #7 lore raw

Re: [PATCH 2/5] Move the UTS namespace under the option

Quoted 8 lines · Cedric Le Goater

Quoted 8 lines

init/Kconfig +0 -0

index fc76773..d592aa2 100644
@@ -409,6 +409,13 @@ config NAMESPACES
 	  or same user id or pid may refer to different tasks when used in
 	  different namespaces.

Quoted 5 lines

init/Kconfig config NAMESPACES · line 414
Quoted 3 lines
init/Kconfig +3 -0
+config UTS_NS
+	bool "UTS namespace"
+	depends on NAMESPACES
should we add a 'default y' like in 2.6.23 ?

I think no. This is an experimental stuff, so the ones who really need it should better say it explicitly.

Quoted 2 lines

C.

Thanks,
Pavel

Pavel Emelyanov

author

2007-10-31 10:08 UTC #8 lore raw

PATCH 3/5 Move the IPC namespace under the option

In reply to Pavel Emelyanov

Currently all the IPC namespace management code is in ipc/util.c. I moved this code into ipc/namespace.c file which is compiled out when needed.

The linux/ipc_namespace.h file is used to store the prototypes of the functions in namespace.c and the stubs for NAMESPACES=n case. This is done so, because the stub for copy_ipc_namespace requires the knoweledge of the CLONE_NEWIPC flag, which is in sched.h. But the linux/ipc.h file itself in included into many many .c files via the sys.h->sem.h sequence so adding the sched.h into it will make all these .c depend on sched.h which is not that good. On the other hand the knowledge about the namespaces stuff is required in 4 .c files only.

Besides, this patch compiles out some auxiliary functions from ipc/sem.c, msg.c and shm.c files. It turned out that moving these functions into namespaces.c is not that easy because they use many other calls and macros from the original file. Moving them would make this patch complicated. On the other hand all these functions can be consolidated, so I will make it separately a bit later.

Signed-off-by Pavel Emelyanov <[email protected]>

---

include/linux/ipc.h +0 ~~-50~~

index 96988d1..b882610 100644
@@ -100,56 +100,6 @@ struct kern_ipc_perm
 	void		*security;
 };
 
-struct ipc_ids;
-struct ipc_namespace {
-	struct kref	kref;
-	struct ipc_ids	*ids[3];
-
-	int		sem_ctls[4];
-	int		used_sems;
-
-	int		msg_ctlmax;
-	int		msg_ctlmnb;
-	int		msg_ctlmni;
-
-	size_t		shm_ctlmax;
-	size_t		shm_ctlall;
-	int		shm_ctlmni;
-	int		shm_tot;
-};
-
-extern struct ipc_namespace init_ipc_ns;
-
-#ifdef CONFIG_SYSVIPC
-#define INIT_IPC_NS(ns)		.ns		= &init_ipc_ns,
-extern void free_ipc_ns(struct kref *kref);
-extern struct ipc_namespace *copy_ipcs(unsigned long flags,
-						struct ipc_namespace *ns);
-#else
-#define INIT_IPC_NS(ns)
-static inline struct ipc_namespace *copy_ipcs(unsigned long flags,
-						struct ipc_namespace *ns)
-{
-	return ns;
-}
-#endif
-
-static inline struct ipc_namespace *get_ipc_ns(struct ipc_namespace *ns)
-{
-#ifdef CONFIG_SYSVIPC
-	if (ns)
-		kref_get(&ns->kref);
-#endif
-	return ns;
-}
-
-static inline void put_ipc_ns(struct ipc_namespace *ns)
-{
-#ifdef CONFIG_SYSVIPC
-	kref_put(&ns->kref, free_ipc_ns);
-#endif
-}
-
 #endif /* __KERNEL__ */
 
 #endif /* _LINUX_IPC_H */

include/linux/ipc_namespace.h new file +67 -0

67 lines not on this page · raw message

init/Kconfig +7 -0

index d592aa2..b1aa7f1 100644
@@ -416,6 +416,13 @@ config UTS_NS
 	  In this namespace tasks see different info provided with the
 	  uname() system call
 
+config IPC_NS
+	bool "IPC namespace"
+	depends on NAMESPACES && SYSVIPC
+	help
+	  In this namespace tasks work with IPC ids which correspond to
+	  different IPC objects in different namespaces
+
 config BLK_DEV_INITRD
 	bool "Initial RAM filesystem and RAM disk (initramfs/initrd) support"
 	depends on BROKEN || !FRV

ipc/Makefile +1 -0

index b93bba6..5fc5e33 100644
@@ -7,4 +7,5 @@ obj-$(CONFIG_SYSVIPC) += util.o msgutil.o msg.o sem.o shm.o
 obj-$(CONFIG_SYSVIPC_SYSCTL) += ipc_sysctl.o
 obj_mq-$(CONFIG_COMPAT) += compat_mq.o
 obj-$(CONFIG_POSIX_MQUEUE) += mqueue.o msgutil.o $(obj_mq-y)
+obj-$(CONFIG_IPC_NS) += namespace.o

ipc/ipc_sysctl.c +1 -0

index 79e24e8..7f4235b 100644
@@ -14,6 +14,7 @@
 #include <linux/nsproxy.h>
 #include <linux/sysctl.h>
 #include <linux/uaccess.h>
+#include <linux/ipc_namespace.h>
 
 static void *get_ipc(ctl_table *table)
 {

ipc/msg.c +3 -0

index 4f1f263..03d0a47 100644
@@ -36,6 +36,7 @@
 #include <linux/seq_file.h>
 #include <linux/rwsem.h>
 #include <linux/nsproxy.h>
+#include <linux/ipc_namespace.h>
 
 #include <asm/current.h>
 #include <asm/uaccess.h>

@@ -91,6 +92,7 @@ static void __msg_init_ns(struct ipc_namespace *ns, struct ipc_ids *ids)
 	ipc_init_ids(ids);
 }
 
+#ifdef CONFIG_IPC_NS
 int msg_init_ns(struct ipc_namespace *ns)
 {
 	struct ipc_ids *ids;

@@ -127,6 +129,7 @@ void msg_exit_ns(struct ipc_namespace *ns)
 	kfree(ns->ids[IPC_MSG_IDS]);
 	ns->ids[IPC_MSG_IDS] = NULL;
 }
+#endif
 
 void __init msg_init(void)
 {

ipc/namespace.c new file +73 -0

73 lines not on this page · raw message

ipc/sem.c +3 -0

index 40ab34d..19e0f6f 100644
@@ -82,6 +82,7 @@
 #include <linux/seq_file.h>
 #include <linux/rwsem.h>
 #include <linux/nsproxy.h>
+#include <linux/ipc_namespace.h>
 
 #include <asm/uaccess.h>
 #include "util.h"

@@ -128,6 +129,7 @@ static void __sem_init_ns(struct ipc_namespace *ns, struct ipc_ids *ids)
 	ipc_init_ids(ids);
 }
 
+#ifdef CONFIG_IPC_NS
 int sem_init_ns(struct ipc_namespace *ns)
 {
 	struct ipc_ids *ids;

@@ -163,6 +165,7 @@ void sem_exit_ns(struct ipc_namespace *ns)
 	kfree(ns->ids[IPC_SEM_IDS]);
 	ns->ids[IPC_SEM_IDS] = NULL;
 }
+#endif
 
 void __init sem_init (void)
 {

ipc/shm.c +3 -0

index 05c97c7..4bbd04e 100644
@@ -38,6 +38,7 @@
 #include <linux/rwsem.h>
 #include <linux/nsproxy.h>
 #include <linux/mount.h>
+#include <linux/ipc_namespace.h>
 
 #include <asm/uaccess.h>

@@ -96,6 +97,7 @@ static void do_shm_rmid(struct ipc_namespace *ns, struct shmid_kernel *shp)
 		shm_destroy(ns, shp);
 }
 
+#ifdef CONFIG_IPC_NS
 int shm_init_ns(struct ipc_namespace *ns)
 {
 	struct ipc_ids *ids;

@@ -131,6 +133,7 @@ void shm_exit_ns(struct ipc_namespace *ns)
 	kfree(ns->ids[IPC_SHM_IDS]);
 	ns->ids[IPC_SHM_IDS] = NULL;
 }
+#endif
 
 void __init shm_init (void)
 {

ipc/util.c +1 ~~-60~~

73 lines not on this page · raw message

ipc/util.h +2 -0

index 9ffea40..fc6b729 100644
@@ -20,6 +20,8 @@ void sem_init (void);
 void msg_init (void);
 void shm_init (void);
 
+struct ipc_namespace;
+
 int sem_init_ns(struct ipc_namespace *ns);
 int msg_init_ns(struct ipc_namespace *ns);
 int shm_init_ns(struct ipc_namespace *ns);

kernel/nsproxy.c +1 -0

index 79f871b..f5d332c 100644
@@ -21,6 +21,7 @@
 #include <linux/utsname.h>
 #include <linux/pid_namespace.h>
 #include <net/net_namespace.h>
+#include <linux/ipc_namespace.h>
 
 static struct kmem_cache *nsproxy_cachep;

Signature · 1 line

1.5.3.4

Pavel Emelyanov

author

2007-10-31 10:15 UTC #9 lore raw

PATCH 4/5 Move the user namespace under the option

In reply to Pavel Emelyanov

We already have a CONFIG_USER_NS option. Just tune it a bit and move the init_user_ns into user.c file to make the kernel compile and work without the namespaces support.

Signed-off-by Pavel Emelyanov <[email protected]>

---

init/Kconfig +8 -9

index b1aa7f1..1ec7009 100644
@@ -206,15 +206,6 @@ config TASK_IO_ACCOUNTING
 
 	  Say N if unsure.
 
-config USER_NS
-	bool "User Namespaces (EXPERIMENTAL)"
-	default n
-	depends on EXPERIMENTAL
-	help
-	  Support user namespaces.  This allows containers, i.e.
-	  vservers, to use user namespaces to provide different
-	  user info for different servers.  If unsure, say N.
-
 config AUDIT
 	bool "Auditing support"
 	depends on NET

@@ -423,6 +414,14 @@ config IPC_NS
 	  In this namespace tasks work with IPC ids which correspond to
 	  different IPC objects in different namespaces
 
+config USER_NS
+	bool "User namespace (EXPERIMENTAL)"
+	depends on NAMESPACES && EXPERIMENTAL
+	help
+	  This allows containers, i.e. vservers, to use user namespaces
+	  to provide different user info for different servers.
+	  If unsure, say N.
+
 config BLK_DEV_INITRD
 	bool "Initial RAM filesystem and RAM disk (initramfs/initrd) support"
 	depends on BROKEN || !FRV

kernel/Makefile +2 -1

index 8082b2c..4c137b5 100644
@@ -4,7 +4,7 @@
 
 obj-y     = sched.o fork.o exec_domain.o panic.o printk.o profile.o \
 	    exit.o itimer.o time.o softirq.o resource.o \
-	    sysctl.o capability.o ptrace.o timer.o user.o user_namespace.o \
+	    sysctl.o capability.o ptrace.o timer.o user.o \
 	    signal.o sys.o kmod.o workqueue.o pid.o \
 	    rcupdate.o extable.o params.o posix-timers.o \
 	    kthread.o wait.o kfifo.o sys_ni.o posix-cpu-timers.o mutex.o \

@@ -49,6 +49,7 @@ obj-$(CONFIG_AUDIT_TREE) += audit_tree.o
 obj-$(CONFIG_KPROBES) += kprobes.o
 obj-$(CONFIG_KGDB) += kgdb.o
 obj-$(CONFIG_UTS_NS) += utsname.o
+obj-$(CONFIG_USER_NS) += user_namespace.o
 obj-$(CONFIG_SYSFS) += ksysfs.o
 obj-$(CONFIG_DETECT_SOFTLOCKUP) += softlockup.o
 obj-$(CONFIG_GENERIC_HARDIRQS) += irq/

kernel/user.c +11 -0

index 9cb6f64..91933d0 100644
@@ -17,6 +17,15 @@
 #include <linux/module.h>
 #include <linux/user_namespace.h>
 
+struct user_namespace init_user_ns = {
+	.kref = {
+		.refcount	= ATOMIC_INIT(2),
+	},
+	.root_user = &root_user,
+};
+
+EXPORT_SYMBOL_GPL(init_user_ns);
+
 /*
  * UID task count cache, to get fast user lookup in "alloc_uid"
  * when changing user ID's (ie setuid() and friends).

@@ -424,6 +433,7 @@ void switch_uid(struct user_struct *new_user)
 	suid_keys(current);
 }
 
+#ifdef CONFIG_USER_NS
 void release_uids(struct user_namespace *ns)
 {
 	int i;

@@ -448,6 +458,7 @@ void release_uids(struct user_namespace *ns)
 
 	free_uid(ns->root_user);
 }
+#endif
 
 static int __init uid_cache_init(void)
 {

kernel/user_namespace.c +0 ~~-13~~

index 7af90fc..4c90062 100644
@@ -10,17 +10,6 @@
 #include <linux/nsproxy.h>
 #include <linux/user_namespace.h>
 
-struct user_namespace init_user_ns = {
-	.kref = {
-		.refcount	= ATOMIC_INIT(2),
-	},
-	.root_user = &root_user,
-};
-
-EXPORT_SYMBOL_GPL(init_user_ns);
-
-#ifdef CONFIG_USER_NS
-
 /*
  * Clone a new ns copying an original user ns, setting refcount to 1
  * @old_ns: namespace to clone

@@ -84,5 +73,3 @@ void free_user_ns(struct kref *kref)
 	release_uids(ns);
 	kfree(ns);
 }
-
-#endif /* CONFIG_USER_NS */

Signature · 1 line

1.5.3.4

Pavel Emelyanov

author

2007-10-31 10:16 UTC #10 lore raw

PATCH 5/5 Move the PID namespace under the option

In reply to Pavel Emelyanov

For the same reasons as with the IPC namespaces, all the prototypes and stubs go to the pid_namespace.h file. The namespace management code itself is moved to the pid_namespace.c file.

The pid_namespace cache is created inside an initcall, i.e. a bit later than the pid hash is initialized. This is OK for now - no code in kernel tries to clone new pid namespaces before boot.

The zap_pid_namespace() function is expanded into a BUG() when PID_NS is "n". This is normal as exiting the init namespace (the only namespace in this case) causes a panic() in exit_child_reaper() function anyway.

Signed-off-by Pavel Emelyanov <[email protected]>

---

include/linux/pid.h +2 -1

index e29a900..e67b130 100644
@@ -121,7 +121,8 @@ extern struct pid *find_ge_pid(int nr, struct pid_namespace *);
 
 extern struct pid *alloc_pid(struct pid_namespace *ns);
 extern void FASTCALL(free_pid(struct pid *pid));
-extern void zap_pid_ns_processes(struct pid_namespace *pid_ns);
+
+int next_pidmap(struct pid_namespace *pid_ns, int last);
 
 /*
  * the helpers to get the pid's id seen from different namespaces

include/linux/pid_namespace.h +27 -0

index 0135c76..a07fcf6 100644
@@ -6,6 +6,7 @@
 #include <linux/threads.h>
 #include <linux/nsproxy.h>
 #include <linux/kref.h>
+#include <linux/err.h>
 
 struct pidmap {
        atomic_t nr_free;

@@ -29,6 +30,7 @@ struct pid_namespace {
 
 extern struct pid_namespace init_pid_ns;
 
+#ifdef CONFIG_PID_NS
 static inline struct pid_namespace *get_pid_ns(struct pid_namespace *ns)
 {
 	if (ns != &init_pid_ns)

@@ -38,12 +40,37 @@ static inline struct pid_namespace *get_pid_ns(struct pid_namespace *ns)
 
 extern struct pid_namespace *copy_pid_ns(unsigned long flags, struct pid_namespace *ns);
 extern void free_pid_ns(struct kref *kref);
+extern void zap_pid_ns_processes(struct pid_namespace *pid_ns);
 
 static inline void put_pid_ns(struct pid_namespace *ns)
 {
 	if (ns != &init_pid_ns)
 		kref_put(&ns->kref, free_pid_ns);
 }
+#else
+static inline struct pid_namespace *get_pid_ns(struct pid_namespace *ns)
+{
+	return ns;
+}
+
+static inline void put_pid_ns(struct pid_namespace *ns)
+{
+}
+
+static inline struct pid_namespace *copy_pid_ns(unsigned long flags,
+		struct pid_namespace *ns)
+{
+	if (flags & CLONE_NEWPID)
+		return ERR_PTR(-EINVAL);
+
+	return ns;
+}
+
+static inline void zap_pid_ns_processes(struct pid_namespace *ns)
+{
+	BUG();
+}
+#endif
 
 static inline struct pid_namespace *task_active_pid_ns(struct task_struct *tsk)
 {

init/Kconfig +8 -0

index 1ec7009..de7f5c9 100644
@@ -422,6 +422,14 @@ config USER_NS
 	  to provide different user info for different servers.
 	  If unsure, say N.
 
+config PID_NS
+	bool "PID namespace"
+	depends on NAMESPACES
+	help
+	  Suport process id namespaces.  This allows having multiple
+	  process with the same pid as long as they are in different
+	  pid namespaces.  This is a building block of containers.
+
 config BLK_DEV_INITRD
 	bool "Initial RAM filesystem and RAM disk (initramfs/initrd) support"
 	depends on BROKEN || !FRV

kernel/Makefile +1 -0

index 4c137b5..bc0dd65 100644
@@ -50,6 +50,7 @@ obj-$(CONFIG_KPROBES) += kprobes.o
 obj-$(CONFIG_KGDB) += kgdb.o
 obj-$(CONFIG_UTS_NS) += utsname.o
 obj-$(CONFIG_USER_NS) += user_namespace.o
+obj-$(CONFIG_PID_NS) += pid_namespace.o
 obj-$(CONFIG_SYSFS) += ksysfs.o
 obj-$(CONFIG_DETECT_SOFTLOCKUP) += softlockup.o
 obj-$(CONFIG_GENERIC_HARDIRQS) += irq/

kernel/pid.c +3 ~~-186~~

223 lines not on this page · raw message

kernel/pid_namespace.c new file +196 -0

196 lines not on this page · raw message

Signature · 1 line

1.5.3.4

Cedric Le Goater

2007-10-31 12:53 UTC #11 lore raw

In reply to Pavel Emelyanov

Quoted 21 lines · Pavel Emelyanov

There were some questions like "do I need this on my cellphone" in reply to different namespaces patches. Indeed, the namespaces are not useful for most of the embedded systems, but the code creating and releasing them weights a lot.
So I propose to add a config option which will help embedded people to reduce the vmlinux size. This option simply compiles out the namespaces cloning and releasing code *only*, but keeps all the other logic untouched (e.g. the notion of init_ns).
When someone tries to clone some namespace with their support turned off, he will receive an EINVAL error.
This patchset can save more than 2KB from the vmlinux when turning the config option "NAMESPACES" to "n".
I do not introduce the NAMESPACES_EXPERIMENTAL config option, that switches all the namespaces we consider experimental, but each namespace has its own config that can be mrked with "depends on EXPERIMENTAL" on demand.

Quoted 4 lines

This is mainly done because some people consider pid namespaces broken ant will probably want to make them depend on BROKEN. In this case we'll have to introduce the NAMESPACES_BROKEN option which is not that good.

I think the discussion finished with an 'immature' status :)

Quoted 1 line

Signed-off-by Pavel Emelyanov <[email protected]>

I'm fine with all these patches and I have a bunch of patches that depend on them already. The sooner they get in the better.

Thanks Pavel !