linux-toradex.git/include/linux/proc_ns.h, branch v4.11-rc3

nsfs: add ioctl to get a parent namespace

2016-09-23T00:59:41+00:00

Pid and user namepaces are hierarchical. There is no way to discover
parent-child relationships.

In a future we will use this interface to dump and restore nested
namespaces.

Acked-by: Serge Hallyn 
Signed-off-by: Andrei Vagin 
Signed-off-by: Eric W. Biederman

kernel: add a helper to get an owning user namespace for a namespace

2016-09-23T00:59:39+00:00

Return -EPERM if an owning user namespace is outside of a process
current user namespace.

v2: In a first version ns_get_owner returned ENOENT for init_user_ns.
    This special cases was removed from this version. There is nothing
    outside of init_user_ns, so we can return EPERM.
v3: rename ns->get_owner() to ns->owner(). get_* usually means that it
grabs a reference.

Acked-by: Serge Hallyn 
Signed-off-by: Andrei Vagin 
Signed-off-by: Eric W. Biederman

cgroup: introduce cgroup namespaces

2016-02-16T18:04:58+00:00

Introduce the ability to create new cgroup namespace. The newly created
cgroup namespace remembers the cgroup of the process at the point
of creation of the cgroup namespace (referred as cgroupns-root).
The main purpose of cgroup namespace is to virtualize the contents
of /proc/self/cgroup file. Processes inside a cgroup namespace
are only able to see paths relative to their namespace root
(unless they are moved outside of their cgroupns-root, at which point
 they will see a relative path from their cgroupns-root).
For a correctly setup container this enables container-tools
(like libcontainer, lxc, lmctfy, etc.) to create completely virtualized
containers without leaking system level cgroup hierarchy to the task.
This patch only implements the 'unshare' part of the cgroupns.

Signed-off-by: Aditya Kali 
Signed-off-by: Serge Hallyn 
Signed-off-by: Tejun Heo

take the targets of /proc//ns/ symlinks to separate fs

2014-12-11T02:30:20+00:00

New pseudo-filesystem: nsfs.  Targets of /proc/*/ns/* live there now.
It's not mountable (not even registered, so it's not in /proc/filesystems,
etc.).  Files on it *are* bindable - we explicitly permit that in do_loopback().

This stuff lives in fs/nsfs.c now; proc_ns_fget() moved there as well.
get_proc_ns() is a macro now (it's simply returning ->i_private; would
have been an inline, if not for header ordering headache).
proc_ns_inode() is an ex-parrot.  The interface used in procfs is
ns_get_path(path, task, ops) and ns_get_name(buf, size, task, ops).

Dentries and inodes are never hashed; a non-counting reference to dentry
is stashed in ns_common (removed by ->d_prune()) and reused by ns_get_path()
if present.  See ns_get_path()/ns_prune_dentry/nsfs_evict() for details
of that mechanism.

As the result, proc_ns_follow_link() has stopped poking in nd->path.mnt;
it does nd_jump_link() on a consistent  pair it gets
from ns_get_path().

Signed-off-by: Al Viro

bury struct proc_ns in fs/proc

2014-12-04T19:34:54+00:00

a) make get_proc_ns() return a pointer to struct ns_common
b) mirror ns_ops in dentry->d_fsdata of ns dentries, so that
is_mnt_ns_file() could get away with fewer dereferences.

That way struct proc_ns becomes invisible outside of fs/proc/*.c

Signed-off-by: Al Viro

new helpers: ns_alloc_inum/ns_free_inum

2014-12-04T19:34:36+00:00

take struct ns_common *, for now simply wrappers around proc_{alloc,free}_inum()

Signed-off-by: Al Viro

make proc_ns_operations work with struct ns_common * instead of void *

2014-12-04T19:34:17+00:00

We can do that now.  And kill ->inum(), while we are at it - all instances
are identical.

Signed-off-by: Al Viro

proc: Split the namespace stuff out into linux/proc_ns.h

2013-05-01T21:29:39+00:00

Split the proc namespace stuff out into linux/proc_ns.h.

Signed-off-by: David Howells 
cc: netdev@vger.kernel.org
cc: Serge E. Hallyn 
cc: Eric W. Biederman 
Signed-off-by: Al Viro