Skip to contentSkip to conversation

Private namespaces

DISCUSSION Adrian Etchevarne 5 participants 6 messages Apr 16, 2003 – Apr 19, 2003

Subsystems (3)
MM core Scheduler exec and binfmt
lore
Share & tools
lore

Adrian Etchevarne

author
#0 lore raw

Hello,
I've been looking for instructions to use private namespaces in Linux,
without results. Can anyone tell where is the documentation about it? (I'm not refering to chroot(), but to /proc/<pid>/mounts). Or the proper files in the kernel sources?

Thanks,
Adrian.

#1 lore raw
Quoted 4 lines · Adrian Etchevarne

I've been looking for instructions to use private namespaces in Linux,
without results. Can anyone tell where is the documentation about it? (I'm not refering to chroot(), but to /proc/<pid>/mounts). Or the proper files in the kernel sources?

A tiny demo program is given in
http://www.win.tue.nl/~aeb/linux/lk/lk-6.html#ss6.3.3

In the kernel source, grep for CLONE_NEWNS.

#5 lore raw
In reply to Adrian Etchevarne

http://www.win.tue.nl/~aeb/linux/lk/lk-6.html

Take a look at 6.3.3 "Per-process namespaces"
[-- snip --]
"BUGS: The program mount does not know about this feature yet, so updates /etc/mtab. Reality is visible in /proc/mounts. Some kernel versions have a bug that would cause the new process to have a strange working directory. Probably that is avoided if this is started with a working directory / or so - not in some mounted filesystem."

I found symlinking /etc/mtab to /proc/self/mounts (or /proc/mounts, mhich is a symlink to /proc/self/mounts) solved the mount bug.

HTH

Regards,

Lee Edward Causier.

Quoted 15 lines · Adrian Etchevarne

Hello,
I've been looking for instructions to use private namespaces in Linux,
without results. Can anyone tell where is the documentation about it? (I'm not refering to chroot(), but to /proc/<pid>/mounts). Or the proper files in the kernel sources?

Thanks,
Adrian.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

#2 lore raw
In reply to Andries Brouwer
Quoted 11 lines · Andries Brouwer
Quoted 4 lines · Adrian Etchevarne

I've been looking for instructions to use private namespaces in Linux,
without results. Can anyone tell where is the documentation about it? (I'm not refering to chroot(), but to /proc/<pid>/mounts). Or the proper files in the kernel sources?

A tiny demo program is given in
http://www.win.tue.nl/~aeb/linux/lk/lk-6.html#ss6.3.3

In the kernel source, grep for CLONE_NEWNS.

I have compiled the sample program on 2.5.67-pre6 and it fails with
clone: Cannot allocate memory
when run as a regular user. Is there a workaround?

Thank you,
florin

Signature · 1 line
"NT is to UNIX what a doughnut is to a particle accelerator."
#3 lore raw
Quoted 3 lines · Florin Iucha

I have compiled the sample program on 2.5.67-pre6 and it fails with
clone: Cannot allocate memory
when run as a regular user. Is there a workaround?

Well, the comment says

"Exercise Play with this in several situations. You may have to be root."

and the source says

        if (! (flags & CLONE_NEWNS))
                return 0;

        if (!capable(CAP_SYS_ADMIN)) {
                put_namespace(namespace);
                return -EPERM;
        }

so there is not much hope for a regular user.

Now you ask: but why ENOMEM?
That is a tiny flaw in the kernel source.
I suppose

fork.c Sat Apr 19 18:21:44 2003 renamed from fork.c~ Tue Mar 25 04:54:46 2003 +2 -1
@@ -873,7 +873,8 @@
                goto bad_fork_cleanup_sighand;
        if (copy_mm(clone_flags, p))
                goto bad_fork_cleanup_signal;
-       if (copy_namespace(clone_flags, p))
+       retval = copy_namespace(clone_flags, p);
+       if (retval)
                goto bad_fork_cleanup_mm;
        retval = copy_thread(0, clone_flags, stack_start, stack_size, p, regs);
        if (retval)

would fix that.

Andries

#4 lore raw
Quoted 3 lines · Andries Brouwer

Now you ask: but why ENOMEM?
That is a tiny flaw in the kernel source.

That code's all fairly careless with its return values, isn't it?

How does this look?

 kernel/fork.c |   23 +++++++++++------------
 1 files changed, 11 insertions(+), 12 deletions(-)
kernel/fork.c renamed from kernel/fork.c~clone-retval-fix +11 -12
diff -puN kernel/fork.c~clone-retval-fix kernel/fork.c
@@ -568,7 +568,7 @@ static inline int copy_fs(unsigned long 
 	}
 	tsk->fs = __copy_fs_struct(current->fs);
 	if (!tsk->fs)
-		return -1;
+		return -ENOMEM;
 	return 0;
 }
 

@@ -703,7 +703,7 @@ static inline int copy_sighand(unsigned 
 	sig = kmem_cache_alloc(sighand_cachep, GFP_KERNEL);
 	tsk->sighand = sig;
 	if (!sig)
-		return -1;
+		return -ENOMEM;
 	spin_lock_init(&sig->siglock);
 	atomic_set(&sig->count, 1);
 	memcpy(sig->action, current->sighand->action, sizeof(sig->action));

@@ -721,7 +721,7 @@ static inline int copy_signal(unsigned l
 	sig = kmem_cache_alloc(signal_cachep, GFP_KERNEL);
 	tsk->signal = sig;
 	if (!sig)
-		return -1;
+		return -ENOMEM;
 	atomic_set(&sig->count, 1);
 	sig->group_exit = 0;
 	sig->group_exit_code = 0;

@@ -866,23 +866,22 @@ static struct task_struct *copy_process(
 	p->security = NULL;
 	p->as_io_context = NULL;
 
-	retval = -ENOMEM;
-	if (security_task_alloc(p))
+	if ((retval = security_task_alloc(p)))
 		goto bad_fork_cleanup;
 	/* copy all the process information */
-	if (copy_semundo(clone_flags, p))
+	if ((retval = copy_semundo(clone_flags, p)))
 		goto bad_fork_cleanup_security;
-	if (copy_files(clone_flags, p))
+	if ((retval = copy_files(clone_flags, p)))
 		goto bad_fork_cleanup_semundo;
-	if (copy_fs(clone_flags, p))
+	if ((retval = copy_fs(clone_flags, p)))
 		goto bad_fork_cleanup_files;
-	if (copy_sighand(clone_flags, p))
+	if ((retval = copy_sighand(clone_flags, p)))
 		goto bad_fork_cleanup_fs;
-	if (copy_signal(clone_flags, p))
+	if ((retval = copy_signal(clone_flags, p)))
 		goto bad_fork_cleanup_sighand;
-	if (copy_mm(clone_flags, p))
+	if ((retval = copy_mm(clone_flags, p)))
 		goto bad_fork_cleanup_signal;
-	if (copy_namespace(clone_flags, p))
+	if ((retval = copy_namespace(clone_flags, p)))
 		goto bad_fork_cleanup_mm;
 	retval = copy_thread(0, clone_flags, stack_start, stack_size, p, regs);
 	if (retval)

_