[PATCH] to nsproxy
Add the pid namespace framework to the nsproxy object. The copy of the pid namespace only increases the refcount on the global pid namespace, init_pid_ns, and unshare is not implemented. There is no configuration option to activate or deactivate this feature because this not relevant for the moment. Signed-off-by: Cedric Le Goater <clg@fr.ibm.com> Cc: Kirill Korotaev <dev@openvz.org> Cc: Eric W. Biederman <ebiederm@xmission.com> Cc: Herbert Poetzl <herbert@13thfloor.at> Cc: Sukadev Bhattiprolu <sukadev@us.ibm.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
parent
61a58c6c23
commit
9a575a92db
5 changed files with 64 additions and 9 deletions
|
@ -7,6 +7,7 @@
|
||||||
#include <linux/utsname.h>
|
#include <linux/utsname.h>
|
||||||
#include <linux/lockdep.h>
|
#include <linux/lockdep.h>
|
||||||
#include <linux/ipc.h>
|
#include <linux/ipc.h>
|
||||||
|
#include <linux/pid_namespace.h>
|
||||||
|
|
||||||
#define INIT_FDTABLE \
|
#define INIT_FDTABLE \
|
||||||
{ \
|
{ \
|
||||||
|
@ -73,6 +74,7 @@
|
||||||
|
|
||||||
extern struct nsproxy init_nsproxy;
|
extern struct nsproxy init_nsproxy;
|
||||||
#define INIT_NSPROXY(nsproxy) { \
|
#define INIT_NSPROXY(nsproxy) { \
|
||||||
|
.pid_ns = &init_pid_ns, \
|
||||||
.count = ATOMIC_INIT(1), \
|
.count = ATOMIC_INIT(1), \
|
||||||
.nslock = __SPIN_LOCK_UNLOCKED(nsproxy.nslock), \
|
.nslock = __SPIN_LOCK_UNLOCKED(nsproxy.nslock), \
|
||||||
.id = 0, \
|
.id = 0, \
|
||||||
|
|
|
@ -7,6 +7,7 @@
|
||||||
struct mnt_namespace;
|
struct mnt_namespace;
|
||||||
struct uts_namespace;
|
struct uts_namespace;
|
||||||
struct ipc_namespace;
|
struct ipc_namespace;
|
||||||
|
struct pid_namespace;
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* A structure to contain pointers to all per-process
|
* A structure to contain pointers to all per-process
|
||||||
|
@ -27,6 +28,7 @@ struct nsproxy {
|
||||||
struct uts_namespace *uts_ns;
|
struct uts_namespace *uts_ns;
|
||||||
struct ipc_namespace *ipc_ns;
|
struct ipc_namespace *ipc_ns;
|
||||||
struct mnt_namespace *mnt_ns;
|
struct mnt_namespace *mnt_ns;
|
||||||
|
struct pid_namespace *pid_ns;
|
||||||
};
|
};
|
||||||
extern struct nsproxy init_nsproxy;
|
extern struct nsproxy init_nsproxy;
|
||||||
|
|
||||||
|
|
|
@ -5,6 +5,8 @@
|
||||||
#include <linux/mm.h>
|
#include <linux/mm.h>
|
||||||
#include <linux/threads.h>
|
#include <linux/threads.h>
|
||||||
#include <linux/pid.h>
|
#include <linux/pid.h>
|
||||||
|
#include <linux/nsproxy.h>
|
||||||
|
#include <linux/kref.h>
|
||||||
|
|
||||||
struct pidmap {
|
struct pidmap {
|
||||||
atomic_t nr_free;
|
atomic_t nr_free;
|
||||||
|
@ -14,10 +16,24 @@ struct pidmap {
|
||||||
#define PIDMAP_ENTRIES ((PID_MAX_LIMIT + 8*PAGE_SIZE - 1)/PAGE_SIZE/8)
|
#define PIDMAP_ENTRIES ((PID_MAX_LIMIT + 8*PAGE_SIZE - 1)/PAGE_SIZE/8)
|
||||||
|
|
||||||
struct pid_namespace {
|
struct pid_namespace {
|
||||||
struct pidmap pidmap[PIDMAP_ENTRIES];
|
struct kref kref;
|
||||||
int last_pid;
|
struct pidmap pidmap[PIDMAP_ENTRIES];
|
||||||
|
int last_pid;
|
||||||
};
|
};
|
||||||
|
|
||||||
extern struct pid_namespace init_pid_ns;
|
extern struct pid_namespace init_pid_ns;
|
||||||
|
|
||||||
|
static inline void get_pid_ns(struct pid_namespace *ns)
|
||||||
|
{
|
||||||
|
kref_get(&ns->kref);
|
||||||
|
}
|
||||||
|
|
||||||
|
extern int copy_pid_ns(int flags, struct task_struct *tsk);
|
||||||
|
extern void free_pid_ns(struct kref *kref);
|
||||||
|
|
||||||
|
static inline void put_pid_ns(struct pid_namespace *ns)
|
||||||
|
{
|
||||||
|
kref_put(&ns->kref, free_pid_ns);
|
||||||
|
}
|
||||||
|
|
||||||
#endif /* _LINUX_PID_NS_H */
|
#endif /* _LINUX_PID_NS_H */
|
||||||
|
|
|
@ -19,6 +19,7 @@
|
||||||
#include <linux/init_task.h>
|
#include <linux/init_task.h>
|
||||||
#include <linux/mnt_namespace.h>
|
#include <linux/mnt_namespace.h>
|
||||||
#include <linux/utsname.h>
|
#include <linux/utsname.h>
|
||||||
|
#include <linux/pid_namespace.h>
|
||||||
|
|
||||||
struct nsproxy init_nsproxy = INIT_NSPROXY(init_nsproxy);
|
struct nsproxy init_nsproxy = INIT_NSPROXY(init_nsproxy);
|
||||||
|
|
||||||
|
@ -68,6 +69,8 @@ struct nsproxy *dup_namespaces(struct nsproxy *orig)
|
||||||
get_uts_ns(ns->uts_ns);
|
get_uts_ns(ns->uts_ns);
|
||||||
if (ns->ipc_ns)
|
if (ns->ipc_ns)
|
||||||
get_ipc_ns(ns->ipc_ns);
|
get_ipc_ns(ns->ipc_ns);
|
||||||
|
if (ns->pid_ns)
|
||||||
|
get_pid_ns(ns->pid_ns);
|
||||||
}
|
}
|
||||||
|
|
||||||
return ns;
|
return ns;
|
||||||
|
@ -111,10 +114,17 @@ int copy_namespaces(int flags, struct task_struct *tsk)
|
||||||
if (err)
|
if (err)
|
||||||
goto out_ipc;
|
goto out_ipc;
|
||||||
|
|
||||||
|
err = copy_pid_ns(flags, tsk);
|
||||||
|
if (err)
|
||||||
|
goto out_pid;
|
||||||
|
|
||||||
out:
|
out:
|
||||||
put_nsproxy(old_ns);
|
put_nsproxy(old_ns);
|
||||||
return err;
|
return err;
|
||||||
|
|
||||||
|
out_pid:
|
||||||
|
if (new_ns->ipc_ns)
|
||||||
|
put_ipc_ns(new_ns->ipc_ns);
|
||||||
out_ipc:
|
out_ipc:
|
||||||
if (new_ns->uts_ns)
|
if (new_ns->uts_ns)
|
||||||
put_uts_ns(new_ns->uts_ns);
|
put_uts_ns(new_ns->uts_ns);
|
||||||
|
@ -129,11 +139,13 @@ int copy_namespaces(int flags, struct task_struct *tsk)
|
||||||
|
|
||||||
void free_nsproxy(struct nsproxy *ns)
|
void free_nsproxy(struct nsproxy *ns)
|
||||||
{
|
{
|
||||||
if (ns->mnt_ns)
|
if (ns->mnt_ns)
|
||||||
put_mnt_ns(ns->mnt_ns);
|
put_mnt_ns(ns->mnt_ns);
|
||||||
if (ns->uts_ns)
|
if (ns->uts_ns)
|
||||||
put_uts_ns(ns->uts_ns);
|
put_uts_ns(ns->uts_ns);
|
||||||
if (ns->ipc_ns)
|
if (ns->ipc_ns)
|
||||||
put_ipc_ns(ns->ipc_ns);
|
put_ipc_ns(ns->ipc_ns);
|
||||||
kfree(ns);
|
if (ns->pid_ns)
|
||||||
|
put_pid_ns(ns->pid_ns);
|
||||||
|
kfree(ns);
|
||||||
}
|
}
|
||||||
|
|
23
kernel/pid.c
23
kernel/pid.c
|
@ -59,6 +59,9 @@ static inline int mk_pid(struct pid_namespace *pid_ns,
|
||||||
* the scheme scales to up to 4 million PIDs, runtime.
|
* the scheme scales to up to 4 million PIDs, runtime.
|
||||||
*/
|
*/
|
||||||
struct pid_namespace init_pid_ns = {
|
struct pid_namespace init_pid_ns = {
|
||||||
|
.kref = {
|
||||||
|
.refcount = ATOMIC_INIT(2),
|
||||||
|
},
|
||||||
.pidmap = {
|
.pidmap = {
|
||||||
[ 0 ... PIDMAP_ENTRIES-1] = { ATOMIC_INIT(BITS_PER_PAGE), NULL }
|
[ 0 ... PIDMAP_ENTRIES-1] = { ATOMIC_INIT(BITS_PER_PAGE), NULL }
|
||||||
},
|
},
|
||||||
|
@ -356,6 +359,26 @@ struct pid *find_ge_pid(int nr)
|
||||||
}
|
}
|
||||||
EXPORT_SYMBOL_GPL(find_get_pid);
|
EXPORT_SYMBOL_GPL(find_get_pid);
|
||||||
|
|
||||||
|
int copy_pid_ns(int flags, struct task_struct *tsk)
|
||||||
|
{
|
||||||
|
struct pid_namespace *old_ns = tsk->nsproxy->pid_ns;
|
||||||
|
int err = 0;
|
||||||
|
|
||||||
|
if (!old_ns)
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
get_pid_ns(old_ns);
|
||||||
|
return err;
|
||||||
|
}
|
||||||
|
|
||||||
|
void free_pid_ns(struct kref *kref)
|
||||||
|
{
|
||||||
|
struct pid_namespace *ns;
|
||||||
|
|
||||||
|
ns = container_of(kref, struct pid_namespace, kref);
|
||||||
|
kfree(ns);
|
||||||
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* The pid hash table is scaled according to the amount of memory in the
|
* The pid hash table is scaled according to the amount of memory in the
|
||||||
* machine. From a minimum of 16 slots up to 4096 slots at one gigabyte or
|
* machine. From a minimum of 16 slots up to 4096 slots at one gigabyte or
|
||||||
|
|
Loading…
Reference in a new issue