Messages in this thread | | | From | Andy Lutomirski <> | Date | Thu, 13 Mar 2014 12:58:14 -0700 | Subject | Re: [PATCH 2/2] net: Implement SO_PEERCGROUP |
| |
On Thu, Mar 13, 2014 at 12:53 PM, Vivek Goyal <vgoyal@redhat.com> wrote: > On Thu, Mar 13, 2014 at 10:55:16AM -0700, Andy Lutomirski wrote: > > [..] >> >> 2. Docker is a container system, so use the "container" (aka >> >> namespace) APIs. There are probably several clever things that could >> >> be done with /proc/<pid>/ns. >> > >> > pid is racy, if it weren't I would simply go straight >> > to /proc/<pid>/cgroups ... >> >> How about: >> >> open("/proc/self/ns/ipc", O_RDONLY); >> send the result over SCM_RIGHTS? > > As I don't know I will ask. So what will server now do with this file > descriptor of client's ipc namespace. > > IOW, what information/identifier does it contain which can be > used to map to pre-configrued per container/per namespace policies.
Inode number, which will match that assigned to the container at runtime.
(I'm not sure this is a great idea -- there's no convention that "I have an fd for a namespace" means "I'm a daemon in that namespace".)
--Andy
> > Thanks > Vivek
-- Andy Lutomirski AMA Capital Management, LLC
| |