[Devel] [PATCH hci-8.1] ve: start the kernel threads of a container in its ve namespace

[Eva Kurchatova <eva.kurchatova@virtuozzo.com>]

The kthreadd and khelper of a container are forked from a worker that
takes over the namespaces, root, credentials and cgroups of the task
starting the container, but not its ve namespace, which nsproxy does
not carry. As task_ve follows the ve namespace, they run as host tasks,
and so do the usermode helpers the container starts: a core dump to a
pipe in a container fails, because the host may not execute a file
from an untrusted container disk.

Switch the worker into the ve namespace of the starting task as well.

Fixes: 4d033dd01fd3 ("ve: Make task_ve pointer ve namespace based")
https://virtuozzo.atlassian.net/browse/VSTOR-152982
Feature: ve: ve generic structures

Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 kernel/ve/ve.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
index 8df881039c3c..ad0d1cf9d5f9 100644
--- a/kernel/ve/ve.c
+++ b/kernel/ve/ve.c
@@ -25,6 +25,7 @@
 #include <linux/mm.h>
 #include <linux/kthread.h>
 #include <linux/nsproxy.h>
+#include <linux/ve_namespace.h>
 #include <linux/fs_struct.h>
 #include <linux/time_namespace.h>
 #include <linux/blkdev.h>
@@ -434,6 +435,8 @@ static void kthread_attach_fn(struct kthread_work *w)
 
 	get_nsproxy(target->nsproxy);
 	switch_task_namespaces(current, target->nsproxy);
+	/* task_ve follows the ve namespace, which nsproxy does not switch */
+	switch_ve_namespace(current, get_ve_ns(target->ve_ns));
 
 	err = unshare_fs_struct();
 	if (err)
-- 
2.56.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel