From: cgel.zte@gmail.com
To: cgel.zte@gmail.com, ebiederm@xmission.com
Cc: akpm@linux-foundation.org, balbir@linux.vnet.ibm.com,
bsingharora@gmail.com, containers@lists.linux.dev,
deng.changcheng@zte.com.cn, linux-kernel@vger.kernel.org,
xu.xin16@zte.com.cn
Subject: Re:Re: [PATCH resend] kernel: Make taskstats available via genetlink per namespace
Date: Sun, 27 Feb 2022 11:16:18 +0000 [thread overview]
Message-ID: <20220227111618.2043152-1-xu.xin16@zte.com.cn> (raw)
In-Reply-To: <20220223045639.1932955-1-xu.xin16@zte.com.cn>
>>> -sh-4.4# ./getdelays -d -p 186 -v
>>> print delayacct stats ON
>>> debug on
>>> Error getting family id, errno 0
>>>
>>> As more and more applications are deployed in containers like Docker,
>>> it is necessary to support getdelays to be used in net namespace.
>>> Taskstats is safe for use per namespace as genetlink checks the
>>> capability of namespace message by netlink_ns_capable().
>>>
>>> Make taskstats available via genetlink per namespace.
>>
>> Let me add a polite nack to this patch.
>
>> Taskstats is completely senseless in a network namespace. There is no
>> translation of identifiers into the context of the receiver of the
>> message.
>
>The interface of taskstats is genetlink that is sensible in net namsespace.
>
>> To make this work requires updating the taskstats code to do something
>> sensible when in a pid namespace, as well as when in a network
>> namespace.
>
> Yes. Taskstats already does convert the input process ID into the task in the
> correspoding pid namsespace. Do you mean to add some check of current user's
> capability like SYS_ADMIN or else?
Actually, here, I think it's meaningful to set the genl_family's netnsok of Taskstat
as true. As you said, Taskstats itself is senseless in a network namespace. So, we
don't have to limit it to the only init_net_ns, it is basically okay to make it
available in all network namespace. Certainly, maybe taskstats itself also needs to
updated, because it does seem to be missing something to just use CAP_NET_ADMIN as the
acquisition restriction of taskstat.
Thanks,
xu xin
prev parent reply other threads:[~2022-02-27 11:16 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20220217093945.1904085-1-xu.xin16@zte.com.cn>
[not found] ` <20220221032202.1925507-1-xu.xin16@zte.com.cn>
2022-02-23 0:00 ` [PATCH resend] kernel: Make taskstats available via genetlink per namespace Eric W. Biederman
2022-02-23 4:56 ` cgel.zte
2022-02-27 11:16 ` cgel.zte [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220227111618.2043152-1-xu.xin16@zte.com.cn \
--to=cgel.zte@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=balbir@linux.vnet.ibm.com \
--cc=bsingharora@gmail.com \
--cc=containers@lists.linux.dev \
--cc=deng.changcheng@zte.com.cn \
--cc=ebiederm@xmission.com \
--cc=linux-kernel@vger.kernel.org \
--cc=xu.xin16@zte.com.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).