From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 3CCF78045D for ; Tue, 3 Nov 2026 02:04:14 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A322udK031487; Tue, 3 Nov 2026 05:02:57 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A322udK031487 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="o7cEocVk" Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A322t9K031483 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Tue, 3 Nov 2026 05:02:55 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A322t9K031483 Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-48df730c035so2501750f8f.0 for ; Mon, 02 Nov 2026 18:02:55 -0800 (PST) X-Gm-Message-State: AFq9FYLGbl3a7s93dsKTrDeRKU9kbyLRSpQojNPjc3QpabNP+nPiM0ij butp9i6xZ/A8BvT5gmHHGUNWczec0vCPjcIp2XbOhrWrP4BJK7EuHGPBvVDPRMrGc5C8Rm2ya2X ivw5e577jr9hHPeGqJuTaaIKwqb+yQoW/oqjuhBksBuHxqDLiK8ZtEw== X-Gm-Gg: AYBFou14RegSmj+u0LDdZk53J4fxCn4PjczKosIZKEBczmSnlHD7s8zcGEkEKtNJ/a/ xG2umAqyvHPYsXl9okc+sm8ejoIgtz5olWsgZbC/mpfmr4cOF3vqQFWYhoeJN2au+osiqVzYdAS JnaeMqlk/qOf4yG8Y8rcaTNIQnWvlnR67wLcsvcwVg+wk+fyEawLZ88BkYh1uT06YFd+Al6CbgN 7NwHwunmkRltY3ahEti62ZRecje8W0KNaRHgi0dmJHCJjcT2XdGr/+JoLOZgHVseXRf5Pxpj5Uw Nl4Kb4skDkB8T/D8TiHajJQklxSXOx8RHNoO+S78Tquz3icZGMgfzx+evXsqfgqNsPmDXuuVKSs 5p5iqTyy1A4/PeHkrjhobecwppg== X-Received: by 2002:a05:600c:8b0a:b0:4a2:e0c:2b0a with SMTP id 5b1f17b1804b1-4ac1709a200mr277333065e9.16.1793671375358; Mon, 02 Nov 2026 18:02:55 -0800 (PST) X-Received: by 2002:a05:600c:8b0a:b0:4a2:e0c:2b0a with SMTP id 5b1f17b1804b1-4ac1709a200mr277332845e9.16.1793671374945; Mon, 02 Nov 2026 18:02:54 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793671374; cv=none; d=google.com; s=arc-20260327; b=odeJOIrETx37o+cgrfWjefuMGZ8hK9p8Qu1mxhUjkfeyF1HT4HMEU3y+x+DUHNXg84 ttD6w7a1MkmAlr9yFweejutOjisShCEW/bNFMNTF/AaacbPbH0G4hg0D+6RlfLdWquyn 8+bIKWbOcbGyi9bW+D9mE6vCt5lY896MXwzDj1YV1ZlwqG4uwCEO1WEnXG+F5sGcHe/M BC2NUSrXiqPSHU6xBvsv7g3eTJeLYcOCpX+jFcJDgAoYyvBMMZ8Yv+sKMJh/YeUYRkef NEevtanIYVr6CGc9KtEuFMau9pD+eY5G/WYsg5q8CiZJBt6NGmmW32zFUpFZ5JADJ+Bd ywZw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:dkim-signature; bh=RneRA84AI0WbNuIlGG2eildKenx0W5035sNKHQ60XBg=; fh=WpT6aB7RBAGHZeWZzqAr71yzRFbPTYkPWKsRagLn48Q=; b=gNntYmHF7qtKHtAeVoni+m4L0MasFiIfz4vKuuy6mvqMaQ1xdL04KD/Kvxm5g11s8M tN6JIU3fGY3FzMLwq7TUh9/3kcskU3hkMYpNaz9so6F/NSt2/elPdRKIE9fKaseeqNsg 5OEhFKnAZqEnqzbHJmH4t4ichig0/TsKr792dB87rAFvFftiKoA09eX01z3cEadVYo16 nOBTG+F6Z1iQWosM9CGL0hE7owG+tsoCwIH4DQ6GCRr3pR2VA/xjmiTFuAJcMxmm0WS0 5cDHGxot0pXkhrutPkk+GC0EJLIJqexcIS4EwuA/EBnc1EBoX/2ICDvunYwsZPbGLqos Ph4w==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=o7cEocVk; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48e71ba446dsi20922941f8f.108.2026.11.02.18.02.54 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 18:02:54 -0800 (PST) Received-SPF: pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=o7cEocVk; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=RneRA84AI0WbNuIlGG2eildKenx0W5035sNKHQ60XBg=; b=o7cEocVk1yA2 ou0sjAnXnduQAigqOASGOkYKiCBlbq+fOlWiOlKy90ZSqYTZwRV9cHJSifwRKOL0gXJ7S+7mVFBM7 S2VNwSd0ikEM/iUgzEOasI/iBSavqz2wOfqccjqC2JcqG/fA2eIpVkMOmuv0K0TkMUdMzWRx2bJ/j naKP7FMDB087UVBxmsVB082yZslJWkhdJtYc+zGG5GE4O14BJDNTH+RAskeNZaYO0IfmHUo7uO/9y uIV3wXCrU3NitaqyAAEg6H6k+iCFQ2kGLqhIf11sIHhR43u2eeK3o0RGMxpzXCfGrkmLW9NmjQg3F PZAxxqOK6PkjyatpE6qvwQ==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=LekKit-T14) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xO3nX-00FYn8-2x; Tue, 03 Nov 2026 03:02:45 +0100 From: Eva Kurchatova To: khorenko@virtuozzo.com Date: Tue, 3 Nov 2026 04:02:34 +0200 Message-ID: <20261103020252.2464400-1-eva.kurchatova@virtuozzo.com> X-Mailer: git-send-email 2.56.0 MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1] ve: start the kernel threads of a container in its ve namespace X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org The kthreadd and khelper of a container are forked from a worker that takes over the namespaces, root, credentials and cgroups of the task starting the container, but not its ve namespace, which nsproxy does not carry. As task_ve follows the ve namespace, they run as host tasks, and so do the usermode helpers the container starts: a core dump to a pipe in a container fails, because the host may not execute a file from an untrusted container disk. Switch the worker into the ve namespace of the starting task as well. Fixes: 4d033dd01fd3 ("ve: Make task_ve pointer ve namespace based") https://virtuozzo.atlassian.net/browse/VSTOR-152982 Feature: ve: ve generic structures Signed-off-by: Eva Kurchatova --- kernel/ve/ve.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c index 8df881039c3c..ad0d1cf9d5f9 100644 --- a/kernel/ve/ve.c +++ b/kernel/ve/ve.c @@ -25,6 +25,7 @@ #include #include #include +#include #include #include #include @@ -434,6 +435,8 @@ static void kthread_attach_fn(struct kthread_work *w) get_nsproxy(target->nsproxy); switch_task_namespaces(current, target->nsproxy); + /* task_ve follows the ve namespace, which nsproxy does not switch */ + switch_ve_namespace(current, get_ve_ns(target->ve_ns)); err = unshare_fs_struct(); if (err) -- 2.56.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel