[Devel] [PATCH hci-8.1] ve: start the kernel threads of a container in its ve namespace

[Devel] [PATCH hci-8.1] ve: start the kernel threads of a container in its ve namespace

[Eva Kurchatova]

The kthreadd and khelper of a container are forked from a worker that
takes over the namespaces, root, credentials and cgroups of the task
starting the container, but not its ve namespace, which nsproxy does
not carry. As task_ve follows the ve namespace, they run as host tasks,
and so do the usermode helpers the container starts: a core dump to a
pipe in a container fails, because the host may not execute a file
from an untrusted container disk.

Switch the worker into the ve namespace of the starting task as well.

Fixes: 4d033dd01fd3 ("ve: Make task_ve pointer ve namespace based")
https://virtuozzo.atlassian.net/browse/VSTOR-152982
Feature: ve: ve generic structures

Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 kernel/ve/ve.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
index 8df881039c3c..ad0d1cf9d5f9 100644
--- a/kernel/ve/ve.c
+++ b/kernel/ve/ve.c
@@ -25,6 +25,7 @@
 #include <linux/mm.h>
 #include <linux/kthread.h>
 #include <linux/nsproxy.h>
+#include <linux/ve_namespace.h>
 #include <linux/fs_struct.h>
 #include <linux/time_namespace.h>
 #include <linux/blkdev.h>
@@ -434,6 +435,8 @@ static void kthread_attach_fn(struct kthread_work *w)
 
 	get_nsproxy(target->nsproxy);
 	switch_task_namespaces(current, target->nsproxy);
+	/* task_ve follows the ve namespace, which nsproxy does not switch */
+	switch_ve_namespace(current, get_ve_ns(target->ve_ns));
 
 	err = unshare_fs_struct();
 	if (err)
-- 
2.56.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1] ve: start the kernel threads of a container in its ve namespace

[no-reply]

> The kthreadd and khelper of a container are forked from a worker that
> takes over the namespaces, root, credentials and cgroups of the task
> starting the container, but not its ve namespace, which nsproxy does
> not carry. As task_ve follows the ve namespace, they run as host tasks,
> and so do the usermode helpers the container starts: a core dump to a
> pipe in a container fails, because the host may not execute a file
> from an untrusted container disk.
> 
> Switch the worker into the ve namespace of the starting task as well.
> 
> Fixes: 4d033dd01fd3 ("ve: Make task_ve pointer ve namespace based")
> https://virtuozzo.atlassian.net/browse/VSTOR-152982
> Feature: ve: ve generic structures
> 
> Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261103020252.2464400-1-eva.kurchatova@virtuozzo.com?part=1


_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1] ve: start the kernel threads of a container in its ve namespace

[Konstantin Khorenko]

On Tue, 03 Nov 2026 04:02:34 +0200, Eva Kurchatova wrote:
> The kthreadd and khelper of a container are forked from a worker that
> takes over the namespaces, root, credentials and cgroups of the task
> starting the container, but not its ve namespace, which nsproxy does
> not carry.

Only kthreadd is forked from the worker. ve_create_kthreadd() points
ve->kthreadd_worker at it for that one fork, then switches to the own
worker of kthreadd, and ve_start_kthreadd() destroys the worker.
ve_start_umh() runs after that, so khelper is forked by the container
kthreadd and inherits the ve namespace from it. Please fix the
sentence, e.g. "The kthreadd of a container is forked from a worker
... Every other kernel thread of the container, khelper included, is
forked from that kthreadd."

> As task_ve follows the ve namespace, they run as host tasks,
> and so do the usermode helpers the container starts: a core dump to a
> pipe in a container fails, because the host may not execute a file
> from an untrusted container disk.

The patch also fixes nfsd in a container. Its threads are created
through the container kthreadd (serv->ve_virtualized), so they had
get_exec_env() == ve0, and nfsd4_umh_cltrack_upcall() passed that to
call_usermodehelper_ve(): the host ran its own nfsdcltrack in the host
root for a client of the container. Worth one sentence, it is a worse
case than the core dump.

> +	/* task_ve follows the ve namespace, which nsproxy does not switch */
> +	switch_ve_namespace(current, get_ve_ns(target->ve_ns));

Optional: "which is not part of nsproxy" is what the comment means.
The FIXME in switch_ve_namespace() and commit_nsset() switch the ve
namespace last, after creds; moving the call after
cgroup_attach_task_all() would keep the two paths alike. Nothing
depends on the order today.

Pasha, could you please review it as well? It changes how the
container kthreads get their task_ve after your 4d033dd01fd3.

With that fixed:

Reviewed-by: Konstantin Khorenko <khorenko@virtuozzo.com>

-- 
Konstantin Khorenko,
Virtuozzo Linux Kernel Team

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1] ve: start the kernel threads of a container in its ve namespace

[Pavel Tikhomirov]

Reviewed-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>

On 11/3/26 03:02, Eva Kurchatova wrote:
> The kthreadd and khelper of a container are forked from a worker that
> takes over the namespaces, root, credentials and cgroups of the task
> starting the container, but not its ve namespace, which nsproxy does
> not carry. As task_ve follows the ve namespace, they run as host tasks,
> and so do the usermode helpers the container starts: a core dump to a
> pipe in a container fails, because the host may not execute a file
> from an untrusted container disk.
> 
> Switch the worker into the ve namespace of the starting task as well.
> 
> Fixes: 4d033dd01fd3 ("ve: Make task_ve pointer ve namespace based")
> https://virtuozzo.atlassian.net/browse/VSTOR-152982
> Feature: ve: ve generic structures
> 
> Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
> ---
>  kernel/ve/ve.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/kernel/ve/ve.c b/kernel/ve/ve.c
> index 8df881039c3c..ad0d1cf9d5f9 100644
> --- a/kernel/ve/ve.c
> +++ b/kernel/ve/ve.c
> @@ -25,6 +25,7 @@
>  #include <linux/mm.h>
>  #include <linux/kthread.h>
>  #include <linux/nsproxy.h>
> +#include <linux/ve_namespace.h>
>  #include <linux/fs_struct.h>
>  #include <linux/time_namespace.h>
>  #include <linux/blkdev.h>
> @@ -434,6 +435,8 @@ static void kthread_attach_fn(struct kthread_work *w)
>  
>  	get_nsproxy(target->nsproxy);
>  	switch_task_namespaces(current, target->nsproxy);
> +	/* task_ve follows the ve namespace, which nsproxy does not switch */
> +	switch_ve_namespace(current, get_ve_ns(target->ve_ns));
>  
>  	err = unshare_fs_struct();
>  	if (err)

-- 
Best regards, Pavel Tikhomirov
Senior Software Developer, Virtuozzo.

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel