[Devel] [PATCH hci-8.1 v2] ve: start the kthreads of a container in its ve namespace

[Devel] [PATCH hci-8.1 v2] ve: start the kthreads of a container in its ve namespace

[Eva Kurchatova]

The kthreadd of a container is forked from a worker that takes over the
namespaces, root, credentials and cgroups of the task starting the
container, but not its ve namespace, which is not part of nsproxy.

As task_ve follows the ve namespace, they all run as host tasks, and so
do the usermode helpers they start, and so a core dump to a pipe in a
container fails, since the host won't execute a file from an untrusted
container disk.

Switch the worker into the ve namespace of the starting task as well,
last, as setns() does.

Fixes: 4d033dd01fd3 ("ve: Make task_ve pointer ve namespace based")
https://virtuozzo.atlassian.net/browse/VSTOR-152982
Feature: ve: ve generic structures

Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---

Changes in v2:
- Only kthreadd is forked from the worker.
- Switch the ve namespace last, after cgroup_attach_task_all(), as
  setns() does, and reword the comment.

Link to v1: http://lore.virtuozzo.com/kernel/b8935ae9-5ac4-4809-8030-f02711174596@virtuozzo.com/T/#t

 kernel/ve/ve.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
index 8df881039c3c..6cdfaaa4e703 100644
--- a/kernel/ve/ve.c
+++ b/kernel/ve/ve.c
@@ -25,6 +25,7 @@
 #include <linux/mm.h>
 #include <linux/kthread.h>
 #include <linux/nsproxy.h>
+#include <linux/ve_namespace.h>
 #include <linux/fs_struct.h>
 #include <linux/time_namespace.h>
 #include <linux/blkdev.h>
@@ -452,6 +453,9 @@ static void kthread_attach_fn(struct kthread_work *w)
 	err = cgroup_attach_task_all(target, current);
 	if (err)
 		goto out;
+
+	/* task_ve follows the ve namespace, which is not part of nsproxy */
+	switch_ve_namespace(current, get_ve_ns(target->ve_ns));
 out:
 	work->result = err;
 	complete(&work->done);
-- 
2.56.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 v2] ve: start the kthreads of a container in its ve namespace

[no-reply]

> The kthreadd of a container is forked from a worker that takes over the
> namespaces, root, credentials and cgroups of the task starting the
> container, but not its ve namespace, which is not part of nsproxy.
> 
> As task_ve follows the ve namespace, they all run as host tasks, and so
> do the usermode helpers they start, and so a core dump to a pipe in a
> container fails, since the host won't execute a file from an untrusted
> container disk.
> 
> Switch the worker into the ve namespace of the starting task as well,
> last, as setns() does.
> 
> Fixes: 4d033dd01fd3 ("ve: Make task_ve pointer ve namespace based")
> https://virtuozzo.atlassian.net/browse/VSTOR-152982
> Feature: ve: ve generic structures
> 
> Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261103173909.2589573-1-eva.kurchatova@virtuozzo.com?part=1


_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 v2] ve: start the kthreads of a container in its ve namespace

[Konstantin Khorenko]

On Tue, 03 Nov 2026 19:37:49 +0200, Eva Kurchatova wrote:
> ve: start the kthreads of a container in its ve namespace

Applied to branch-rh10-6.12.0-211.52.1.22.x.vz10-ovz, will be released in rh10-6.12.0-211.52.1.22.17.vz10, thanks!

[1/1] ve: start the kthreads of a container in its ve namespace
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/a532182e96ae

-- 
Konstantin Khorenko,
Virtuozzo Linux Kernel Team


_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel