LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Pavel Emelyanov <xemul@openvz.org>
To: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: serge@hallyn.com, Alexey Dobriyan <adobriyan@openvz.org>,
	Linux Netdev List <netdev@vger.kernel.org>,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH 0/2] Fix /proc/net in presence of net namespaces
Date: Wed, 05 Mar 2008 12:43:40 +0300	[thread overview]
Message-ID: <47CE6B4C.4010009@openvz.org> (raw)
In-Reply-To: <m1ejaq2jh4.fsf@ebiederm.dsl.xmission.com>

Eric W. Biederman wrote:
> Pavel Emelyanov <xemul@openvz.org> writes:
> 
>>>>> - Have readdir and lookup filter the directory entries by the pid
>>>>>   namespace of the proc mount.
>>>> So, how are you going to filter the lookup? The problem I see - you have
>>>> a process that opened the /proc/.netns/X directory (he onws that namespace)
>>>> and the other one trying to do the same. The VFS layer finds the hashed
>>>> dentry corresponding to this /proc/.netns/X. The only way you can prevent
>>>> VFS from giving one to the second task is to override .d_revalidate method 
>>>> and drop that dentry....
>>>>
>>>> But we've already tried to walk this way with no luck.
>>> I meant a per mount filtering.  Exactly like we do for the pids now.
>> We (me) do not perform any "filtering" in /proc. I just make /proc play 
>> the VFS rules - one super-block one tree of dentries.
> 
> Exactly.  For different super blocks we return a different set of
> processes and a different set of numbers of those processes.  If you
> do use ids that do not live in a namespace I agree you do not need to
> do different things for different mounts, but that seems ugly and
> problematic.
> 
>>>>> If we make namespaces show up anywhere besides under
>>>>> "/proc/<pid>/task/<tid>/" we have to do something like this, and pids
>>>>> are largely designed for this kind of use.
>>>> Proc consists of two parts - the <pid>-s one with generated-on-the-fly
>>>> entries and the static one that is represented by proc_dir_entry tree.
>>>> Do you propose to mix those two?
>>> Yes.  Because the static entries are beginning to depend on process
>>> specific attributes.  We have already started with /proc/mounts.
>> /proc/<pid>/mounts is not represented with any proc_dir_entry, but
>> what you're proposing with /proc/<pid>/net seems like doing this
>> representation.
> 
> Yes.  I am talking about placing things represented with a
> prod_dir_entry and having them show up under a hierarchy not
> represented with proc_dir_entries under /proc/<pid>.
> 
> As that is clean, worked well for /proc/mounts, does not
> require ids at all, and is essentially the optimal form
> for monitoring processes.
> 
> /proc/mounts used to have a proc_dir_entry.  When it was reimplemented
> to be per fs namespace that was removed.
> 
>>>>> just need a non-global id for our directory entries so we don't paint
>>>>> ourselves into a corner.
>>>> What namespace do you mean by "non-global"?
>>> The best is an id I can take with me when I migrate from machine A
>>> to machine B.  An id in some namespace or a form that doesn't need
>>> an id at all is the core requirement.
>> If we're OK in having a /proc/netns/<xxx> for each namespace, then
>> this <xxx> is an id, regardless whatever it is - a pre-generated 
>> number, a pointer, etc.
>>
>> That said, your only wish is to make this <xxx> be preservable across 
>> migration, right?
> 
> No, that is not my only wish.
> 
> - I wish for a clean maintainable interface.
> - I wish for an interface that we can use for monitoring programs like
>   top and ps.
> - I wish for an interface that is migration safe.
> 
> It is my opinion that using an id is simply an optimization to reduce
> the number of cached proc dentries.
> 
> I gave a full run down of what I wish and the reasons for it earlier
> in this thread. I have not seen you respond to that message.

I took you opinion, expressed in this letter, into account.

> Currently I am NOT ok having a /proc/netns/<xxx>. It appears to be
> a contentious premature optimization.

Have you changed your mind suddenly? 
You told opposite less than a week ago.

> VFS clean, maintainable, and usable for monitoring is
> /proc/<pid>/task/<tid>/net.

Why not /proc/pid/net? Are we ever going to move threads in namespace?

> We can always figure out how to optimize that form later.
> 
> Eric
> 

  reply	other threads:[~2008-03-05  9:44 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2008-02-28 15:46 Pavel Emelyanov
2008-02-28 15:49 ` [PATCH 1/2] Add an id to struct net Pavel Emelyanov
2008-02-28 15:51 ` [PATCH 2/2] Make /proc/net a symlink and drop proc shadows Pavel Emelyanov
2008-02-28 19:31 ` [PATCH 0/2] Fix /proc/net in presence of net namespaces Eric W. Biederman
2008-02-28 21:17   ` serge
2008-02-28 22:39     ` Eric W. Biederman
2008-02-29  3:17       ` serge
2008-02-29  8:16         ` Pavel Emelyanov
2008-02-29 15:38           ` serge
2008-02-29  7:58       ` Pavel Emelyanov
2008-03-02  2:03         ` Eric W. Biederman
2008-03-02  2:17         ` Eric W. Biederman
2008-03-03  9:07           ` Pavel Emelyanov
2008-03-04 22:49             ` Eric W. Biederman
2008-03-05  9:43               ` Pavel Emelyanov [this message]
2008-02-29  7:44     ` Pavel Emelyanov
2008-02-29  7:42   ` Pavel Emelyanov
2008-03-02  2:29     ` Eric W. Biederman
2008-03-03  8:52       ` Pavel Emelyanov
2008-03-04 22:23         ` Eric W. Biederman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=47CE6B4C.4010009@openvz.org \
    --to=xemul@openvz.org \
    --cc=adobriyan@openvz.org \
    --cc=ebiederm@xmission.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=serge@hallyn.com \
    --subject='Re: [PATCH 0/2] Fix /proc/net in presence of net namespaces' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).