[PATCH 2/6] user namespaces: move user_ns from nsproxy into user struct
Serge E. Hallyn
serue at us.ibm.com
Tue Jul 29 10:59:32 PDT 2008
Quoting Eric W. Biederman (ebiederm at xmission.com):
> "Serge E. Hallyn" <serue at us.ibm.com> writes:
> >>From ec5f54faf5afd16cb6cef40ebaaf3da25989d185 Mon Sep 17 00:00:00 2001
> > From: Serge Hallyn <serue at us.ibm.com>
> > Date: Thu, 24 Jul 2008 17:52:41 -0500
> > Subject: [PATCH 2/6] user namespaces: move user_ns from nsproxy into user struct
> > When we get the sysfs support needed to support fair user scheduling
> > along with user namespaces, then we will need to be able to get the
> > user namespace from the user struct.
> > So we need the user_ns to be a part of struct user. Once we can
> > access it from tsk->user, we no longer have a use for
> > tsk->nsproxy->user_ns.
> Is this true? Even in the general case of supporting setuid and setgid
> and everything else that potentially is in the user namespace?
Sure. At any time we can get tsk->user->user_ns, and from that we can
> I certainly support the cleanups you have made for the reasons you describe.
> I think however that there is there are no technical reasons not to have
> nsproxy->user_ns after the changes have been made.
Well I ended up tossing it to clarify my thinking about the refcounting.
With that done, I think we could safely not have nsproxy pin the
user_ns, trusting the tsk->user to pin it instead.
But keeping it in two places just seems needlessly complicated.
> I also agree that
> there are no technical reasons for keeping nsproxy->user_ns at the moment.
What is your preference?
> > When a user_namespace is created, the user which created it is
> > marked as its 'creator'. The user_namespace pins the creator.
> > Each userid in a user_ns pins the user_ns. This keeps refcounting
> > nice and simple.
More information about the Containers