Mapping PIDs from parent->child namespaces

DISCUSSION Mike Heffner 4 participants 11 messages Jan 3, 2011 – Jan 5, 2011 7 messages not in the archive Proc filesystem

lore

Share & tools

lore

Mike Heffner

author

2011-01-03 23:02 UTC #0 lore raw

Hi,

Is it possible for a process running in a parent PID namespace to map the PID of a process running in a child's namespace from the parent->child's namespace? For example, if I span the process "myproc" with CLONE_NEWPID then a call to getpid() inside myproc will return "1" whereas in the parent's namespace that process could actually be PID "23495". I'd like to be able to know that 23495 maps to 1 in the new NS. Obviously, just mapping the first PID is straightforward since I can just look at the result of clone(). However, mapping the PIDs of processes subsequently forked from "myproc" -- in this example -- I haven't been able to figure out.

Thanks,

Mike

Daniel Lezcano

2011-01-04 16:04 UTC #2 lore raw

In reply to a message not in the archive

Quoted 12 lines · Mike Heffner

Hi,
Is it possible for a process running in a parent PID namespace to map the PID of a process running in a child's namespace from the parent->child's namespace? For example, if I span the process "myproc" with CLONE_NEWPID then a call to getpid() inside myproc will return "1" whereas in the parent's namespace that process could actually be PID "23495". I'd like to be able to know that 23495 maps to 1 in the new NS. Obviously, just mapping the first PID is straightforward since I can just look at the result of clone(). However, mapping the PIDs of processes subsequently forked from "myproc" -- in this example -- I haven't been able to figure out.

AFAIK, it is not possible.

That would be very nice to show the pid <-> vpid association.

The procfs is a good candidate to show these informations.

That would makes sense to show the content of /proc/<pid>/status with the pid relatively to the namespace.

Let me give an example:

Assuming the process '1234' creates a new pid namespace, and the child which is '1' in the new namespace has the real pid '4321'. This one mounts its /proc.

If the process '1234' looks at /proc/4321/root/proc/1/status, it sees:

...
Tgid: 1
Pid: 1
PPid: 0
...

It could be:

...
Tgid: 4321
Pid: 4321
PPid: 1234
...

as the file is inspected from the parent namespace. Of course, if the file is looked from the child namespace context, we will see '1', '1' and '0'.

I suppose the patch in the kernel should very small also.

Thoughts ?

Thanks.
-- Daniel

Sauf indication contraire ci-dessus:
Compagnie IBM France
Siège Social : Tour Descartes, 2, avenue Gambetta, La Défense 5, 92400 Courbevoie
RCS Nanterre 552 118 465
Forme Sociale : S.A.S.
Capital Social : 542.737.118 ?
SIREN/SIRET : 552 118 465 02430

Cedric Le Goater

2011-01-04 16:44 UTC #4 lore raw

In reply to a message not in the archive

Quoted 46 lines · Daniel Lezcano

Quoted 12 lines · Mike Heffner
Hi,
Is it possible for a process running in a parent PID namespace to map the PID of a process running in a child's namespace from the parent->child's namespace? For example, if I span the process "myproc" with CLONE_NEWPID then a call to getpid() inside myproc will return "1" whereas in the parent's namespace that process could actually be PID "23495". I'd like to be able to know that 23495 maps to 1 in the new NS. Obviously, just mapping the first PID is straightforward since I can just look at the result of clone(). However, mapping the PIDs of processes subsequently forked from "myproc" -- in this example -- I haven't been able to figure out.
AFAIK, it is not possible.
That would be very nice to show the pid <-> vpid association.
The procfs is a good candidate to show these informations.
That would makes sense to show the content of /proc/<pid>/status with the pid relatively to the namespace.
Let me give an example:
Assuming the process '1234' creates a new pid namespace, and the child which is '1' in the new namespace has the real pid '4321'. This one mounts its /proc.
If the process '1234' looks at /proc/4321/root/proc/1/status, it sees:
...
Tgid: 1
Pid: 1
PPid: 0
...
It could be:
...
Tgid: 4321
Pid: 4321
PPid: 1234
...

Quoted 7 lines

as the file is inspected from the parent namespace. Of course, if the file is looked from the child namespace context, we will see '1', '1' and '0'.
I suppose the patch in the kernel should very small also.
Thoughts ?

we use the following patch to get the pid of a task as seen from its pid namespace. It can be useful to identify tasks writing pids in files.

Cheers,

fs/proc/array.c +7 -0

index fff6572..9a7bfde 100644
@@ -337,6 +337,12 @@ static void task_cpus_allowed(struct seq_file *m, struct task
        seq_printf(m, "\n");
 }
 
+static void task_vpid(struct seq_file *m, struct task_struct *task)
+{
+       struct pid_namespace *ns = task_active_pid_ns(task);
+       seq_printf(m, "Vpid:\t%d\n", ns ? task_pid_nr_ns(task, ns) : 0);
+}
+
 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
                        struct pid *pid, struct task_struct *task)
 {

@@ -357,6 +363,7 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *
        task_show_regs(m, task);
 #endif
        task_context_switch_counts(m, task);
+       task_vpid(m, task);
        return 0;
 }

Mike Heffner

author

2011-01-04 19:57 UTC #13 lore raw

In reply to a message not in the archive

Quoted 46 lines · Daniel Lezcano

Quoted 12 lines · Mike Heffner
Hi,
Is it possible for a process running in a parent PID namespace to map the PID of a process running in a child's namespace from the parent->child's namespace? For example, if I span the process "myproc" with CLONE_NEWPID then a call to getpid() inside myproc will return "1" whereas in the parent's namespace that process could actually be PID "23495". I'd like to be able to know that 23495 maps to 1 in the new NS. Obviously, just mapping the first PID is straightforward since I can just look at the result of clone(). However, mapping the PIDs of processes subsequently forked from "myproc" -- in this example -- I haven't been able to figure out.
AFAIK, it is not possible.
That would be very nice to show the pid<-> vpid association.
The procfs is a good candidate to show these informations.
That would makes sense to show the content of /proc/<pid>/status with the pid relatively to the namespace.
Let me give an example:
Assuming the process '1234' creates a new pid namespace, and the child which is '1' in the new namespace has the real pid '4321'. This one mounts its /proc.
If the process '1234' looks at /proc/4321/root/proc/1/status, it sees:
...
Tgid: 1
Pid: 1
PPid: 0
...
It could be:
...
Tgid: 4321
Pid: 4321
PPid: 1234
...

Quoted 7 lines

as the file is inspected from the parent namespace. Of course, if the file is looked from the child namespace context, we will see '1', '1' and '0'.
I suppose the patch in the kernel should very small also.
Thoughts ?

Would that mean that finding the pid->vpid association for a real PID X requires checking all files /proc/<X>/root/proc/<Y>/status where Y is all vpids until you find the one where Pid == X? It would be nice to have a have a way to check a single file for the association where vpid is not known beforehand -- unless I'm misunderstanding your solution.

Cheers,

Mike

Mike Heffner

author

2011-01-04 20:17 UTC #6 lore raw

In reply to a message not in the archive

Quoted 51 lines · Cedric Le Goater

Quoted 50 lines · Daniel Lezcano
Quoted 12 lines · Mike Heffner
Hi,
Is it possible for a process running in a parent PID namespace to map the PID of a process running in a child's namespace from the parent->child's namespace? For example, if I span the process "myproc" with CLONE_NEWPID then a call to getpid() inside myproc will return "1" whereas in the parent's namespace that process could actually be PID "23495". I'd like to be able to know that 23495 maps to 1 in the new NS. Obviously, just mapping the first PID is straightforward since I can just look at the result of clone(). However, mapping the PIDs of processes subsequently forked from "myproc" -- in this example -- I haven't been able to figure out.
AFAIK, it is not possible.
That would be very nice to show the pid<-> vpid association.
The procfs is a good candidate to show these informations.
That would makes sense to show the content of /proc/<pid>/status with the pid relatively to the namespace.
Let me give an example:
Assuming the process '1234' creates a new pid namespace, and the child which is '1' in the new namespace has the real pid '4321'. This one mounts its /proc.
If the process '1234' looks at /proc/4321/root/proc/1/status, it sees:
...
Tgid: 1
Pid: 1
PPid: 0
...
It could be:
...
Tgid: 4321
Pid: 4321
PPid: 1234
...
as the file is inspected from the parent namespace. Of course, if the file is looked from the child namespace context, we will see '1', '1' and '0'.

Quoted 7 lines

Quoted 3 lines
I suppose the patch in the kernel should very small also.
Thoughts ?
we use the following patch to get the pid of a task as seen from its pid namespace. It can be useful to identify tasks writing pids in files.

Great, I'll try it out. Has there been any interest in getting this into the mainline? Are there negatives to advertising child vpid's?

Cheers,

Mike

Serge Hallyn

2011-01-04 20:49 UTC #8 lore raw

In reply to a message not in the archive

Quoted 8 lines · Mike Heffner

Quoted 3 lines · Cedric Le Goater
we use the following patch to get the pid of a task as seen from its pid namespace. It can be useful to identify tasks writing pids in files.
Great, I'll try it out. Has there been any interest in getting this into the mainline? Are there negatives to advertising child vpid's?

I see no problems offhand with that patch.

Daniel Lezcano

2011-01-04 22:02 UTC #12 lore raw

In reply to a message not in the archive

Quoted 78 lines · Cedric Le Goater

Quoted 45 lines · Daniel Lezcano
Quoted 12 lines · Mike Heffner
Hi,
Is it possible for a process running in a parent PID namespace to map the PID of a process running in a child's namespace from the parent->child's namespace? For example, if I span the process "myproc" with CLONE_NEWPID then a call to getpid() inside myproc will return "1" whereas in the parent's namespace that process could actually be PID "23495". I'd like to be able to know that 23495 maps to 1 in the new NS. Obviously, just mapping the first PID is straightforward since I can just look at the result of clone(). However, mapping the PIDs of processes subsequently forked from "myproc" -- in this example -- I haven't been able to figure out.
AFAIK, it is not possible.
That would be very nice to show the pid<-> vpid association.
The procfs is a good candidate to show these informations.
That would makes sense to show the content of /proc/<pid>/status with the pid relatively to the namespace.
Let me give an example:
Assuming the process '1234' creates a new pid namespace, and the child which is '1' in the new namespace has the real pid '4321'. This one mounts its /proc.
If the process '1234' looks at /proc/4321/root/proc/1/status, it sees:
...
Tgid: 1
Pid: 1
PPid: 0
...
It could be:
...
Tgid: 4321
Pid: 4321
PPid: 1234
...
Quoted 7 lines
as the file is inspected from the parent namespace. Of course, if the file is looked from the child namespace context, we will see '1', '1' and '0'.
I suppose the patch in the kernel should very small also.
Thoughts ?
we use the following patch to get the pid of a task as seen from its pid namespace. It can be useful to identify tasks writing pids in files.
Cheers,
C.
fs/proc/array.c +6 -0
index fff6572..9a7bfde 100644
@@ -337,6 +337,12 @@ static void task_cpus_allowed(struct seq_file *m, struct task
         seq_printf(m, "\n");
  }
 
+static void task_vpid(struct seq_file *m, struct task_struct *task)
+{
+       struct pid_namespace *ns = task_active_pid_ns(task);
+       seq_printf(m, "Vpid:\t%d\n", ns ? task_pid_nr_ns(task, ns) : 0);
+}
+
  int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
                         struct pid *pid, struct task_struct *task)
  {

fs/proc/array.c int proc_pid_status(struct seq_file *m, struct pid_namespace * · line 368

Quoted 6 lines

fs/proc/array.c +1 -0

@@ -357,6 +363,7 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *
         task_show_regs(m, task);
  #endif
         task_context_switch_counts(m, task);
+       task_vpid(m, task);
         return 0;
  }

Right, it is another way to show the vpid but is it enough ? I mean if there are multiple pid namespaces, you will see the vpid '2' or whatever several times in different /proc/<pid>/status, you will need extra information to group these processes to belong to a specific pid namespace, no ?

I am also worried about the 'status' file format and if it is allowed to add a line in it ... dunno ...

The solution I was proposing is quite similar to this patch, it is just the 'task_state' function which is modified to show the pid number relatively to the pid namespace which is looking at the file.

If we are the parent pid namespace, we can look at /proc/<pid>/root/proc/<vpids>
* we have the list of the processes with the vpids which are the
<vpid> filename
* as we are the parent pid namespace, we look at
/proc/<pid>/root/proc/<vpid>/status and the pids number are the real pids.
* if we are in the child pid namespace, we will see the vpid.

It is similar to the /cgroup/tasks file where the pid numbers are different depending on what pid namespace we are looking from.

By this way, we don't change the status file format, we have the list of the processes belonging to a pid namespace with <vpid> and <pid> and we support nested pid namespaces.

Daniel Lezcano

2011-01-04 22:13 UTC #15 lore raw

In reply to a message not in the archive

Quoted 54 lines · Mike Heffner

Quoted 53 lines · Daniel Lezcano
Quoted 13 lines · Mike Heffner
Hi,
Is it possible for a process running in a parent PID namespace to map the PID of a process running in a child's namespace from the parent->child's namespace? For example, if I span the process "myproc" with CLONE_NEWPID then a call to getpid() inside myproc will return "1" whereas in the parent's namespace that process could actually be PID "23495". I'd like to be able to know that 23495 maps to 1 in the new NS.
Obviously, just mapping the first PID is straightforward since I can just look at the result of clone(). However, mapping the PIDs of processes subsequently forked from "myproc" -- in this example -- I haven't been able to figure out.
AFAIK, it is not possible.
That would be very nice to show the pid<-> vpid association.
The procfs is a good candidate to show these informations.
That would makes sense to show the content of /proc/<pid>/status with the pid relatively to the namespace.
Let me give an example:
Assuming the process '1234' creates a new pid namespace, and the child which is '1' in the new namespace has the real pid '4321'. This one mounts its /proc.
If the process '1234' looks at /proc/4321/root/proc/1/status, it sees:
...
Tgid:    1
Pid:    1
PPid:    0
...
It could be:
...
Tgid:    4321
Pid:    4321
PPid:    1234
...
as the file is inspected from the parent namespace. Of course, if the file is looked from the child namespace context, we will see '1', '1' and '0'.
I suppose the patch in the kernel should very small also.

Quoted 8 lines

Quoted 1 line
Thoughts ?
Would that mean that finding the pid->vpid association for a real PID X requires checking all files /proc/<X>/root/proc/<Y>/status where Y is all vpids until you find the one where Pid == X? It would be nice to have a have a way to check a single file for the association where vpid is not known beforehand -- unless I'm misunderstanding your solution.

Hmm, right. But how do you know a pid is belonging to a specific pid namespace ? I mean you can have a single process creating several pid namespaces. So while looking at the /proc/<pid>/status, you can see several times the same vpid, no ?
I am not sure the kind of informations you want to collect but it is not really a problem to build an association table from the userspace by browsing the /proc/<pid>/root/proc/<vpids> and their corresponding pid from the 'status' file information.

Do you have an example for a pid -> vpid association without looking at more informations from /proc ?

Mike Heffner

author

2011-01-05 04:50 UTC #17 lore raw

In reply to a message not in the archive

Quoted 64 lines · Daniel Lezcano

Quoted 54 lines · Mike Heffner
Quoted 53 lines · Daniel Lezcano
Quoted 13 lines · Mike Heffner
Hi,
Is it possible for a process running in a parent PID namespace to map the PID of a process running in a child's namespace from the parent->child's namespace? For example, if I span the process "myproc" with CLONE_NEWPID then a call to getpid() inside myproc will return "1" whereas in the parent's namespace that process could actually be PID "23495". I'd like to be able to know that 23495 maps to 1 in the new NS.
Obviously, just mapping the first PID is straightforward since I can just look at the result of clone(). However, mapping the PIDs of processes subsequently forked from "myproc" -- in this example -- I haven't been able to figure out.
AFAIK, it is not possible.
That would be very nice to show the pid<-> vpid association.
The procfs is a good candidate to show these informations.
That would makes sense to show the content of /proc/<pid>/status with the pid relatively to the namespace.
Let me give an example:
Assuming the process '1234' creates a new pid namespace, and the child which is '1' in the new namespace has the real pid '4321'. This one mounts its /proc.
If the process '1234' looks at /proc/4321/root/proc/1/status, it sees:
...
Tgid: 1
Pid: 1
PPid: 0
...
It could be:
...
Tgid: 4321
Pid: 4321
PPid: 1234
...
as the file is inspected from the parent namespace. Of course, if the file is looked from the child namespace context, we will see '1', '1' and '0'.
I suppose the patch in the kernel should very small also.
Quoted 8 lines
Quoted 1 line
Thoughts ?
Would that mean that finding the pid->vpid association for a real PID X requires checking all files /proc/<X>/root/proc/<Y>/status where Y is all vpids until you find the one where Pid == X? It would be nice to have a have a way to check a single file for the association where vpid is not known beforehand -- unless I'm misunderstanding your solution.

Quoted 8 lines

Hmm, right. But how do you know a pid is belonging to a specific pid namespace ? I mean you can have a single process creating several pid namespaces. So while looking at the /proc/<pid>/status, you can see several times the same vpid, no ?
I am not sure the kind of informations you want to collect but it is not really a problem to build an association table from the userspace by browsing the /proc/<pid>/root/proc/<vpids> and their corresponding pid from the 'status' file information.

Yeah, I see how that could be a problem. I guess I was coming from an assumption that you knew which namespace a real PID came from just not which vpid it was in that namespace.

Quoted 4 lines

Do you have an example for a pid -> vpid association without looking at more informations from /proc ?

I actually did discover another solution. My original requirement was for an application monitoring solution where procs in a child namespace need to contact an agent running in the root namespace. In this example, the agent needs to know the real PID in order to query stats from /proc and to know when the process has exited.

I originally tested SO_PEERCRED, but that just returned the vpid. However, it does look like this was patched in 2.6.36 with:

http://www.spinics.net/lists/linux-containers/msg20944.html

SO_PEERCRED now returns the realpid in the agent while my application can communicate the vpid over the socket.

Cedric Le Goater

2011-01-05 13:50 UTC #9 lore raw

In reply to a message not in the archive

Quoted 6 lines · Mike Heffner

Quoted 3 lines
we use the following patch to get the pid of a task as seen from its pid namespace. It can be useful to identify tasks writing pids in files.
Great, I'll try it out. Has there been any interest in getting this into the mainline?

hmm, it has been talked over a few years ago. I can't find the pointer anymore.

Quoted 1 line

Are there negatives to advertising child vpid's?

I don't think so but the issue is more on gathering clear requirements for it.

The patch is simple enough to be discussed rapidly and eventually be accepted if it is considered useful enough. It does add a user/kernel API, which is always a concern. I'm not in favor of exposing too much of the pid stuff, already overly complex with the nested pid namespace, but the result of getpid() from a task pov sounds like a legitimate information to expose.

Why do you need it ?

Cedric Le Goater

2011-01-05 13:54 UTC #11 lore raw

In reply to a message not in the archive

Quoted 1 line · Cedric Le Goater

Why do you need it ?

I see you answered that question in another thread.