Re: [RFC][v4][PATCH 7/7]: Define clone_with_pids syscall
[Posted August 12, 2009 by jake]
| From: |
| Pavel Machek <pavel-AT-ucw.cz> |
| To: |
| Sukadev Bhattiprolu <sukadev-AT-linux.vnet.ibm.com> |
| Subject: |
| Re: [RFC][v4][PATCH 7/7]: Define clone_with_pids syscall |
| Date: |
| Mon, 10 Aug 2009 16:54:25 +0200 |
| Message-ID: |
| <20090810145425.GA1378@ucw.cz> |
| Cc: |
| linux-kernel-AT-vger.kernel.org, Oren Laadan <orenl-AT-cs.columbia.edu>,
"Eric W. Biederman" <ebiederm-AT-xmission.com>, serue-AT-us.ibm.com,
Alexey Dobriyan <adobriyan-AT-gmail.com>,
Pavel Emelyanov <xemul-AT-openvz.org>,
Andrew Morton <akpm-AT-osdl.org>, torvalds-AT-linux-foundation.org,
mikew-AT-google.com, mingo-AT-elte.hu, hpa-AT-zytor.com,
Containers <containers-AT-lists.linux-foundation.org>,
sukadev-AT-us.ibm.com |
| Archive‑link: | |
Article |
Hi!
>
> Subject: [RFC][v4][PATCH 7/7]: Define clone_with_pids syscall
>
> Container restart requires that a task have the same pid it had when it was
> checkpointed. When containers are nested the tasks within the containers
> exist in multiple pid namespaces and hence have multiple pids to specify
> during restart.
>
> clone_with_pids(), intended for use during restart, is the same as clone(),
> except that it takes a 'target_pid_set' paramter. This parameter lets caller
> choose specific pid numbers for the child process, in the process's active
> and ancestor pid namespaces. (Descendant pid namespaces in general don't
> matter since processes don't have pids in them anyway, but see comments
> in copy_target_pids() regarding CLONE_NEWPID).
This should go to documentation/manpage somewhere.
> Unlike clone(), clone_with_pids() needs CAP_SYS_ADMIN, at least for now, to
> prevent unprivileged processes from misusing this interface.
>
> Call clone_with_pids as follows:
>
> pid_t pids[] = { 0, 77, 99 };
> struct pid_set pid_set;
>
> pid_set.num_pids = sizeof(pids) / sizeof(int);
> pid_set.pids = &pids;
>
> syscall(__NR_clone_with_pids, flags, stack, NULL, NULL, NULL, &pid_set);
>
> If a target-pid is 0, the kernel continues to assign a pid for the process in
> that namespace. In the above example, pids[0] is 0, meaning the kernel will
> assign next available pid to the process in init_pid_ns. But kernel will assign
> pid 77 in the child pid namespace 1 and pid 99 in pid namespace 2. If either
> 77 or 99 are taken, the system call fails with -EBUSY.
>
> If 'pid_set.num_pids' exceeds the current nesting level of pid namespaces,
> the system call fails with -EINVAL.
Does it make sense to set the pid in anything but innermost container?
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blo...
