mirror of
https://github.com/checkpoint-restore/criu.git
synced 2026-07-29 21:12:29 +00:00
b8556e8084
We have collected a good set of calls that cannot be done inside user namespaces, but we need to [1]. Some of them has already being addressed, like prctl mm bits restore, but some are not. I'm pretty sceptical about the ability to relax the security checks on quite a lot of them (e.g. open-by-handle is indeed a very dangerous operation if allowed to unpriviledged user), so we need some way to call those things even in user namespaces. The good news about it its that all the calls I've found operate on file descriptors this way or another. So if we had a process, that lived outside of user namespace, we could ask one to do the high priority operation we need and exchange the affected file descriptor via unix socket. So the usernsd is the one doing exactly this. It starts before we create the user namespace and accepts requests via unix socket. Clients (the processes we restore) send him the functions they want to call, the descriptor they want to operate on and the arguments blob. Optionally, they can request some file descriptor back after the call. In non usernamespace case the daemon is not started and the calls are done right in the requestor's process environment. In the next patch there's an example of how to use this daemon to do the priviledged SO_SNDBUFFORCE/_RCVBUFFORCE sockopt on a socket. [1] http://criu.org/UserNamespace Signed-off-by: Pavel Emelyanov <xemul@parallels.com> Acked-by: Andrew Vagin <avagin@openvz.org>
63 lines
1.1 KiB
C
63 lines
1.1 KiB
C
#ifndef __CR_RST_INFO_H__
|
|
#define __CR_RST_INFO_H__
|
|
|
|
#include "lock.h"
|
|
#include "list.h"
|
|
#include "vma.h"
|
|
|
|
struct task_entries {
|
|
int nr_threads, nr_tasks, nr_helpers;
|
|
futex_t nr_in_progress;
|
|
futex_t start;
|
|
mutex_t zombie_lock;
|
|
atomic_t cr_err;
|
|
mutex_t userns_sync_lock;
|
|
};
|
|
|
|
struct fdt {
|
|
int nr; /* How many tasks share this fd table */
|
|
pid_t pid; /* Who should restore this fd table */
|
|
/*
|
|
* The fd table is ready for restoing, if fdt_lock is equal to nr
|
|
* The fdt table was restrored, if fdt_lock is equal to nr + 1
|
|
*/
|
|
futex_t fdt_lock;
|
|
};
|
|
|
|
struct _MmEntry;
|
|
|
|
struct rst_info {
|
|
struct list_head fds;
|
|
struct list_head eventpoll;
|
|
struct list_head tty_slaves;
|
|
|
|
void *premmapped_addr;
|
|
unsigned long premmapped_len;
|
|
unsigned long clone_flags;
|
|
|
|
void *munmap_restorer;
|
|
|
|
int nr_zombies;
|
|
|
|
int service_fd_id;
|
|
struct fdt *fdt;
|
|
|
|
struct vm_area_list vmas;
|
|
struct _MmEntry *mm;
|
|
|
|
u32 cg_set;
|
|
|
|
union {
|
|
struct pstree_item *pgrp_leader;
|
|
futex_t pgrp_set;
|
|
};
|
|
|
|
struct file_desc *cwd;
|
|
struct file_desc *root;
|
|
bool has_umask;
|
|
u32 umask;
|
|
|
|
void *breakpoint;
|
|
};
|
|
|
|
#endif /* __CR_RST_INFO_H__ */
|