• Eric W. Biederman's avatar
    ns: proc files for namespace naming policy. · 6b4e306a
    Eric W. Biederman authored
    Create files under /proc/<pid>/ns/ to allow controlling the
    namespaces of a process.
    
    This addresses three specific problems that can make namespaces hard to
    work with.
    - Namespaces require a dedicated process to pin them in memory.
    - It is not possible to use a namespace unless you are the child
      of the original creator.
    - Namespaces don't have names that userspace can use to talk about
      them.
    
    The namespace files under /proc/<pid>/ns/ can be opened and the
    file descriptor can be used to talk about a specific namespace, and
    to keep the specified namespace alive.
    
    A namespace can be kept alive by either holding the file descriptor
    open or bind mounting the file someplace else.  aka:
    mount --bind /proc/self/ns/net /some/filesystem/path
    mount --bind /proc/self/fd/<N> /some/filesystem/path
    
    This allows namespaces to be named with userspace policy.
    
    It requires additional support to make use of these filedescriptors
    and that will be comming in the following patches.
    Acked-by: default avatarDaniel Lezcano <daniel.lezcano@free.fr>
    Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
    6b4e306a
base.c 82 KB