Pavel Emelyanov <xemul@xxxxxxxxxxxxx> writes: > Thanks. What's the problem with setns? joining a preexisting namespace is roughly the same problem as unsharing a namespace. We simply haven't figure out how to do it safely for the pid and the uid namespaces. >> I have designed these file descriptors to pin the namespaces, so >> waiting for them to exit isn't something they can do now. It makes a >> lot of sense to have similar ones that take weak references to the namespaces >> that we can use to wait for a namespace to exit. > > Yes, I saw this from patches. Eric, I'd very much appreciate if we > workout a solution that will allow us to kill two birds with one stone. > I do not want to invent yet another bunch of system calls for "taking > weak reference". Definitely. I only consider the current interface to be a mushy not set in stone. > As a "brain storm" start up. Can we use inotify/dnotify for this? > Or maybe we should better equip the nsfd call with flags argument and > add a flag for weak reference? In that case - how shall we get a > notification about namespace is dead? With poll? Maybe worth making > the sys_close return only when the namespace is dead (by providing a > proper ->release callback of a file)? We would want poll to work, anything else is a weird work-around. The challenging part is that we don't have any infrastructure for notifying when a namespace goes away. So that has to be built before we can wire it up to userspace. I don't expect it is too difficult but there is work to be done. Eric -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
