From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id A9D568017D for ; Tue, 3 Nov 2026 17:40:30 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A3HdDk2009591; Tue, 3 Nov 2026 20:39:14 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A3HdDk2009591 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="VFwA+ep7" Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A3HdC1s009587 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Tue, 3 Nov 2026 20:39:12 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A3HdC1s009587 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-48b02d63407so3465034f8f.0 for ; Tue, 03 Nov 2026 09:39:12 -0800 (PST) X-Gm-Message-State: APuU4Z+7OiZG0ujyuu4oqqWyA/osyymhGYtUKnEDiyuxqCHvt6aghWqk fZyvHmEa1RrACTDkMh5DX/FKzaD+c6S/MCgVfrWNVO3T/IdbJPtJ1f3bSbwZomqciFxqDjKZfyO ujAPtAzk6wdc49Mc+LnHPWj/lfWp0g1cntAyI3agsLOWST0GNWcUR1g== X-Gm-Gg: AYBFou0etfabUAwTAFvT/SAQ1NvtKKFc920cs/i/qTBGLOkRRbXU1LIxyfSqjHnsG/A /ERWlV5OARLSc9s2+771jV5/jkR2f1qtvwXYgNj3FJ1ERXWMiTqanyEHQI1VrINa4h+N/d8hQy/ IVOKnJKB8RSB/NjCB91F+mRpm+vYsAN66Ty23QfiTkG14UAdqDhVvsWM/RkuW/Y0AltVIKszU53 YvTIAKOvlKCNj/6tEnE4Aop4zpMNDXUA+OMSe5NvWHcpKZMrhSwKuLzrJ7VKSMM2qELc7t2BrJQ dO8f60l5jJByxX83GtcIoB/RybAzsq56+hZo2wHSo2xpj1SGy1lS3Zj36NnuK9JvCSONcXAdNYa Rz9cTTEylM+UegWFHBzaSYqMUAw== X-Received: by 2002:a05:6000:186c:b0:48e:7a19:7aad with SMTP id ffacd0b85a97d-48e7a197e64mr24810224f8f.6.1793727551807; Tue, 03 Nov 2026 09:39:11 -0800 (PST) X-Received: by 2002:a05:6000:186c:b0:48e:7a19:7aad with SMTP id ffacd0b85a97d-48e7a197e64mr24810188f8f.6.1793727551306; Tue, 03 Nov 2026 09:39:11 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793727551; cv=none; d=google.com; s=arc-20260327; b=JUNMIT0JCde9hSlgo4IqHI3x4cXLznOSl+NgHmK0A6VHL4m5F6Jrv0YsjcFFSKKVaS Sz/5lnBODjRjkktBIW0fNyvusSDqlxke+NWEbJJkiA9cve37gcdNYHrgK2DeviHSO0/q fd1UTACk3p+yo4XofwdNu9Pep+Qwu02Q9iJVBbJz+zqckoeme0EffPzZOiUocoObHHzG Sul10fM6LWCreT0d3zNXCeVjZj4T6YKGWUgdih8uWCGaflrLrVG4HUt59Dj19NrA/JMQ xMTdpHVc6tZCTMmlSlIy1+6PjCF7fFQAVVLYW/dRW29hurFUNHTAdLvVoQlGfJTtkOoQ Gdfw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:dkim-signature; bh=s5u66zwk32e7PutffAwxS13ly/zyjHokX5VuNnFgNv0=; fh=WpT6aB7RBAGHZeWZzqAr71yzRFbPTYkPWKsRagLn48Q=; b=DQ+m7h39cG2zJNEqatsAPkI7lr3ONQAhcCiSgQOFw+R9FH6DkMOgi4CesbUC+7Lwct wAvu7l7AApSMNtVWGom860JBPzH+u2h/lqN4cbLlJZ2Qqe3INGO3MBl39gYD/FSM+AwP om8FavpflZBb83gSG5rhSXqH+sklZLO7ZbcLztFMUwmUDueG6kz6itNKXbQka/iyb+zd IosIjrGk5HAbthqJafxHQvThdQGh4VaErp/8AhvPGtH/M0/gjTG/9YqlwdyqXEoJZqQl tcGpsKgTmzuwdJRGEGDMV6q1FXdi0Prdhe2PA7BjlVepKjrXwHGiZ14gddJM3v+n/sTc fLMg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=VFwA+ep7; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48e71bbf91esi23568863f8f.285.2026.11.03.09.39.11 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Nov 2026 09:39:11 -0800 (PST) Received-SPF: pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=VFwA+ep7; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=s5u66zwk32e7PutffAwxS13ly/zyjHokX5VuNnFgNv0=; b=VFwA+ep7nfIT bGb3XiCFedJvCyYUmd3D9wZBmzMMfMBCdN8gBHpTVkUL4Js+NU/6A3onpwS0knqDgiQ0uTns1ng8a YgPHkLOHbHeVdF2pdM6i74fnSKjDcoouFA0k+fkw6gt+tI9KIkt9aShm9v+J3A+3gBub4FmtKdT6O gNALyxcjF4h9t62yH6UG4zdfSF4KMxqdoV0iRzv7pAkAQWE1dXcBghOr+08dGHsR2/f7wSsnRkVap +dcJlZmdTIIBDSoB1Rgg4dSUY5vSv7MfJLVDY+NpuDmHsVmBnDMZkdvkGLle3LdCOE9hwUYCyMEqH b3x9Woee0PC0skmgOgfFRg==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=LekKit-T14) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xOIPb-004a5w-0o; Tue, 03 Nov 2026 18:39:00 +0100 From: Eva Kurchatova To: khorenko@virtuozzo.com Date: Tue, 3 Nov 2026 19:37:49 +0200 Message-ID: <20261103173909.2589573-1-eva.kurchatova@virtuozzo.com> X-Mailer: git-send-email 2.56.0 MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v2] ve: start the kthreads of a container in its ve namespace X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org The kthreadd of a container is forked from a worker that takes over the namespaces, root, credentials and cgroups of the task starting the container, but not its ve namespace, which is not part of nsproxy. As task_ve follows the ve namespace, they all run as host tasks, and so do the usermode helpers they start, and so a core dump to a pipe in a container fails, since the host won't execute a file from an untrusted container disk. Switch the worker into the ve namespace of the starting task as well, last, as setns() does. Fixes: 4d033dd01fd3 ("ve: Make task_ve pointer ve namespace based") https://virtuozzo.atlassian.net/browse/VSTOR-152982 Feature: ve: ve generic structures Signed-off-by: Eva Kurchatova --- Changes in v2: - Only kthreadd is forked from the worker. - Switch the ve namespace last, after cgroup_attach_task_all(), as setns() does, and reword the comment. Link to v1: http://lore.virtuozzo.com/kernel/b8935ae9-5ac4-4809-8030-f02711174596@virtuozzo.com/T/#t kernel/ve/ve.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c index 8df881039c3c..6cdfaaa4e703 100644 --- a/kernel/ve/ve.c +++ b/kernel/ve/ve.c @@ -25,6 +25,7 @@ #include #include #include +#include #include #include #include @@ -452,6 +453,9 @@ static void kthread_attach_fn(struct kthread_work *w) err = cgroup_attach_task_all(target, current); if (err) goto out; + + /* task_ve follows the ve namespace, which is not part of nsproxy */ + switch_ve_namespace(current, get_ve_ns(target->ve_ns)); out: work->result = err; complete(&work->done); -- 2.56.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel