From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 45AA38045D for ; Tue, 3 Nov 2026 10:12:10 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A3AAk5a003858; Tue, 3 Nov 2026 13:10:47 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A3AAk5a003858 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="jgY4tMCH" Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A3AAjnp003854 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Tue, 3 Nov 2026 13:10:45 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A3AAjnp003854 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-48e00f3929bso306180f8f.0 for ; Tue, 03 Nov 2026 02:10:45 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBx5I0bjZ08rUG3VvSnb5PkH96w+/uHAehArFFJOzS/4Fw0aYKqys89caoakoz4SysOYT7y2Pw==@openvz.org X-Gm-Message-State: APuU4Z/wQ3ZoGyXK4WArhrFkN/lSvhT4foCMTZHC/tgc0KLpuPRYDDFl xyHX8a7gKtvVLadhh1yLNSyX9YIvt5MXNy8HMSVGs1SdCdM1kFNe1t/EXFAEUwp0/tKlvyMd+vT WLh4oUTEqbOyel6+MiF5izd1JWy23PWvc8plKp+61Wjb8D6T4Lg/Uiw== X-Gm-Gg: AYBFou1sMS9RXlNsl6nnqzxigb5qyKcWD9pgkl0Lh+pMuSgr0Dq79eiOBKIZ1b/5wxe wrNfjZw5S4BvHiSmSsNiZ3zibrQ2nSJzAVS7nEgqEOUcDYr8dtYg5VY3bK2We/7vpxt8UnHNV6p WWsVRBcEGNMlSZZDx7qd6phqUytiT9MslZRknamuxHyVbv3XuCG68HC9l4un81YwgcIqqgYnGUN HdbXk+9Bxx+N7U1lipisAPLTDw+c0lztkxFHpD8V48rIR1k61wtT8iNeaafa1Eeff5SBCIoIe+d kk5SEGw8ckVh49/v+zW8LBu2DfxOS9oUpS6WoIcbjhvVwSpFtsWjyhocybEMmlExYjuoZDfk4oP K2sCDpAqubbRXkXDW X-Received: by 2002:a05:6000:4012:b0:48e:678d:396e with SMTP id ffacd0b85a97d-48e678d39eemr36928626f8f.9.1793700644915; Tue, 03 Nov 2026 02:10:44 -0800 (PST) X-Received: by 2002:a05:6000:4012:b0:48e:678d:396e with SMTP id ffacd0b85a97d-48e678d39eemr36928560f8f.9.1793700644196; Tue, 03 Nov 2026 02:10:44 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793700644; cv=none; d=google.com; s=arc-20260327; b=E5cA3iQKjyD+8oYVqsjvhrSPC/1UdiTzINzZCK6U1mHkO4iXRV+bkDys3N0hJwqBzz 9XHLKh9QGzblfuKqqjlfsPgyZRzV5Ktf7II8H+sJikmy4fz7QIkTEg2NK8rRVuhH15H0 gZVfNvKSnckVtp2ChmKCJyyczGDeVudaYwFFCeKNuaSLvxKpabEEJnExYGW4Wm8X7in8 sDY4g1g0fTJzSp3XuByQrt/2Q7uNtPawiBAKBtt2tXPlskPN59wK32rnOdNId9yKQ0z1 5EekLo0TOyHpqoZeCvCBFsnMdUc7ZNqdfNxjrVa8zgmPmYv0wdqUtXkzf/FAQ+kC59OK YP3g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=message-id:date:references:in-reply-to:cc:to:from:subject :content-transfer-encoding:mime-version:dkim-signature; bh=+X5wCxZ7IqzGpgtgzz5ctRXvmP17OhvvLLjqcfxrLAo=; fh=I77sIG7op56RpShXzJxjIk/NFAt+6b2PQGXG51YN1VA=; b=ksqmEO9S8hXF13B5jzHLdoBOC3opOQgeYMbjjBr0H/ZbpIrcrkkId/MRgqY0N+yF51 anJlduzJcXQf5O2YIIscL/DeLmbWpo7QnZbu8RmRyXnDakaxcwfBu5DFV5u3XWMqcuh8 2DjgXLse71Ir1u5AVDY9aThzv3+mE21aDTB/ULPTZvwqFeWIDxR5PNYXN7HqgRZ1e33N sBQ4P2Pvj4W8WMZzfy4Jww6QXvpA88wca08xtCMgQ324E6pLM6A3KBulHzsNT3U1Sn/A u8xCix62VLqynaBGFN6PxcKo9fhbTtE+/VUG/ZkHL5pp1gedDGn5z+KyIRshi7M0CM2S yeQA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=jgY4tMCH; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48e71ba2fc1si33964774f8f.118.2026.11.03.02.10.44 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Nov 2026 02:10:44 -0800 (PST) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=jgY4tMCH; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Date:From:Subject:Content-Type: MIME-Version; bh=+X5wCxZ7IqzGpgtgzz5ctRXvmP17OhvvLLjqcfxrLAo=; b=jgY4tMCHkplo SJ+NFHNqOtTkSXk8Z793LkaBUDhQgWNhYzmfYPJGvGVDLWNwjUjCNO5vDucMiGYIqg9LPq+OaXTv+ CjB6pkFlb0fvNSRNrRVqJqt+IV+UbSDcodoPLJR80636kVVs1/8WciVjJnWOIBPsKfGSSVG/ceoFz /1fZVRUIRuE7PyAE3vHuH5Oz5LCuUg98Hrp+gTVMx2Q9BPzbc/Ng2LVKKg+o7L3BLkqt6D1LCulQw Dt0+wcOyGcypBB+SGErB4vvBkplQf1Pves50bofTv7ndEPBMHhJnHA/463pgIas5jsfNdKSSY8MOj WB/RJ+kxJgs3FK4Ak/bDnQ==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xOBPc-00BKVF-21; Tue, 03 Nov 2026 11:10:34 +0100 MIME-Version: 1.0 From: Konstantin Khorenko To: Eva Kurchatova , Pavel Tikhomirov In-Reply-To: <20261103020252.2464400-1-eva.kurchatova@virtuozzo.com> References: <20261103020252.2464400-1-eva.kurchatova@virtuozzo.com> Date: Tue, 03 Nov 2026 11:10:40 +0100 Message-Id: <179370064092.2387336.10899245587121249748.b4-review@b4> X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2116; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=OniI/pHsTzuIMZYhDCUSo2zjJhb+QCr6ajB1ihqN9RI=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBq6bMjsZtw01Rjzf+O3qfWVfnGxrx3h3jdgdHQg EVnaRLNtQyJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCaumzIwAKCRBRlgpH+WFc KhdHD/4ng7IGZTPMVQv31GsxVjyVJwt1bw2Ukqg6tAjiZCNikNIHK3cRNujSqqcl5vqiieNB08l F1Liw7MVkHvfozzmaqYaKh+WQunwxQLDZxrKAV2gttdHVifm5+WLr8WvVWuVV1Bgzw3R79xMNhV qDIsl+sU++E8m7aWy9drgghjolpP+k7F8h3DmCCICqxlWVZ3CujeqS6SP1ox8itILoXBHuCc77S gAaiFDnKgEQR6DU0Qb3x6b80eh4kioYQMZ/ty9M0SsZNuIdGoZ+IRY81QF8lK9/6r8J0/L9UtmI 5K0tB3Yd7IgRjSUldoFuQvFrzhP1zEDnoekdtled5MJeUOeTiWLBY5ddCsDjmnwNrrt8NrpZ5Kz TmwX04m0Df1//pHX6SfOtrFExV/lvNF0+80IsFYYSvT4q0PRyK21LmLf5xKSXVaFrlOGvUg4Ezl gymb8FF9wdkrm3qJ4jBC06Fy9wNSh1ZDdHiGLZzuRYlPERIzyfKDt9C2Y5RPE/MOtfWvULTDPs3 TIzf5g738EpBX2SBVevtblW7dotDZtE3rGmKfQwyba+4fTY1/y4QWcZM8Kp/fi0SMq92X9ViInQ OmHdS2Bj4W6Dqk2ZVM6TqiRcJWsjqwrL7vb5n29rq7t72Ev3GGrHwdphplyfYw1kXbuFS9rP+BF aHpWSk07XjKC8DA== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: Re: [Devel] [PATCH hci-8.1] ve: start the kernel threads of a container in its ve namespace X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org On Tue, 03 Nov 2026 04:02:34 +0200, Eva Kurchatova wrote: > The kthreadd and khelper of a container are forked from a worker that > takes over the namespaces, root, credentials and cgroups of the task > starting the container, but not its ve namespace, which nsproxy does > not carry. Only kthreadd is forked from the worker. ve_create_kthreadd() points ve->kthreadd_worker at it for that one fork, then switches to the own worker of kthreadd, and ve_start_kthreadd() destroys the worker. ve_start_umh() runs after that, so khelper is forked by the container kthreadd and inherits the ve namespace from it. Please fix the sentence, e.g. "The kthreadd of a container is forked from a worker ... Every other kernel thread of the container, khelper included, is forked from that kthreadd." > As task_ve follows the ve namespace, they run as host tasks, > and so do the usermode helpers the container starts: a core dump to a > pipe in a container fails, because the host may not execute a file > from an untrusted container disk. The patch also fixes nfsd in a container. Its threads are created through the container kthreadd (serv->ve_virtualized), so they had get_exec_env() == ve0, and nfsd4_umh_cltrack_upcall() passed that to call_usermodehelper_ve(): the host ran its own nfsdcltrack in the host root for a client of the container. Worth one sentence, it is a worse case than the core dump. > + /* task_ve follows the ve namespace, which nsproxy does not switch */ > + switch_ve_namespace(current, get_ve_ns(target->ve_ns)); Optional: "which is not part of nsproxy" is what the comment means. The FIXME in switch_ve_namespace() and commit_nsset() switch the ve namespace last, after creds; moving the call after cgroup_attach_task_all() would keep the two paths alike. Nothing depends on the order today. Pasha, could you please review it as well? It changes how the container kthreads get their task_ve after your 4d033dd01fd3. With that fixed: Reviewed-by: Konstantin Khorenko -- Konstantin Khorenko, Virtuozzo Linux Kernel Team _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel