[Devel] [PATCH hci-8.1 v2] ve: start the kthreads of a container in its ve namespace

[Eva Kurchatova <eva.kurchatova@virtuozzo.com>]

The kthreadd of a container is forked from a worker that takes over the
namespaces, root, credentials and cgroups of the task starting the
container, but not its ve namespace, which is not part of nsproxy.

As task_ve follows the ve namespace, they all run as host tasks, and so
do the usermode helpers they start, and so a core dump to a pipe in a
container fails, since the host won't execute a file from an untrusted
container disk.

Switch the worker into the ve namespace of the starting task as well,
last, as setns() does.

Fixes: 4d033dd01fd3 ("ve: Make task_ve pointer ve namespace based")
https://virtuozzo.atlassian.net/browse/VSTOR-152982
Feature: ve: ve generic structures

Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---

Changes in v2:
- Only kthreadd is forked from the worker.
- Switch the ve namespace last, after cgroup_attach_task_all(), as
  setns() does, and reword the comment.

Link to v1: http://lore.virtuozzo.com/kernel/b8935ae9-5ac4-4809-8030-f02711174596@virtuozzo.com/T/#t

 kernel/ve/ve.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
index 8df881039c3c..6cdfaaa4e703 100644
--- a/kernel/ve/ve.c
+++ b/kernel/ve/ve.c
@@ -25,6 +25,7 @@
 #include <linux/mm.h>
 #include <linux/kthread.h>
 #include <linux/nsproxy.h>
+#include <linux/ve_namespace.h>
 #include <linux/fs_struct.h>
 #include <linux/time_namespace.h>
 #include <linux/blkdev.h>
@@ -452,6 +453,9 @@ static void kthread_attach_fn(struct kthread_work *w)
 	err = cgroup_attach_task_all(target, current);
 	if (err)
 		goto out;
+
+	/* task_ve follows the ve namespace, which is not part of nsproxy */
+	switch_ve_namespace(current, get_ve_ns(target->ve_ns));
 out:
 	work->result = err;
 	complete(&work->done);
-- 
2.56.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel