On Thu, Feb 25, 2010 at 12:57:02PM -0800, Eric W. Biederman wrote: > > Introduce two new system calls: > int nsfd(pid_t pid, unsigned long nstype); > int setns(unsigned long nstype, int fd); > > These two new system calls address three specific problems that can > make namespaces hard to work with. > - Namespaces require a dedicated process to pin them in memory. > - It is not possible to use a namespace unless you are the > child of the original creator. > - Namespaces don't have names that userspace can use to talk > about them. > > The nsfd() system call returns a file descriptor that can > be used to talk about a specific namespace, and to keep > the specified namespace alive. > > The fd returned by nsfd() can be bind mounted as: > mount --bind /proc/self/fd/N /some/filesystem/path > to keep the namespace alive indefinitely as long as > it is mounted. > > open works on the fd returned by nsfd() so another > process can get a hold of it and do interesting things. > > Overall that allows for persistent naming of namespaces > according to userspace policy. > > setns() allows changing the namespace of the current process > to a namespace that originates with nsfd(). > > Signed-off-by: Eric W. Biederman <ebiederm@xxxxxxxxxxxx> Hi Eric, Seems like an ok concept to me. Did you try doing this with anon_inodes and bind mounting the /proc/<pid>/fd/N as above to keep them alive and name them? Cheers, -Matt Helsley -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
